873 matches found
Astra Linux – Vulnerability in Apache2
Delayed memory release after the effective lifetime vulnerability in the Apache HTTP Server. This issue affects the Apache HTTP Server: from version 2.4.17 up to 2.4.63. Users are recommended to upgrade to version 2.4.64, which fixes this issue...
Astra Linux – Vulnerability in Puma
Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, Puma exhibited incorrect behavior when parsing chunked transfer encoding bodies, allowing HTTP request smuggling. The fixed versions limit the size of chunk extensions. Without this limitation, an...
Astra Linux – Vulnerability in Wireshark
The TLS protocol dissector infinite loop in Wireshark versions 4.6.0 to 4.6.4 allows for denial of service attacks...
CVE-2026-34501
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue...
EUVD-2026-53736
The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post types that the site registered as...
CVE-2026-13153
The CVE-2026-13153 entry concerns the Gutenberg Essential Blocks WordPress plugin prior to 6.4.0. The issue is that a public REST route is not access-restricted and the response over-fetches a non-public WooCommerce per-product sales metric, allowing unauthenticated users to read the lifetime num...
CVE-2026-13153 Essential Blocks < 6.4.0 - Unauthenticated WooCommerce Sales Data Disclosure via REST products Endpoint
The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-product sales metric into the response, allowing unauthenticated users to read the lifetime number of units sold for any published...
CVE-2026-70596 Ghost: Cross-Site Scripting in Feature Image Captions
Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue allowed any staff user to create a post with content in featureimagecaption that could be used to hijack another staff user's Ghost Admin session, resulting in privilege escalation. This issue is fixe...
CVE-2026-17561 Unauthenticated RCE in Innotim Software's Logsign SIEM
Improper Control of Generation of Code 'Code Injection' vulnerability in Innotim Software, Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Code Injection. This issue affects Logsign SIEM: before 6.4.108...
CVE-2017-3634
creationtimestamp| type| source ---|---|--- 2026-07-29 12:01:45+00:00| seen| Telegram/-zzzJ6WyGgd0bbH69QyBWy0gZPvCZNNfcCn-gTP7taOVg 2026-07-30 00:02:02+00:00| seen| Telegram/-zzzJ6WyGgd0bbH69QyBWy0gZPvCZNNfcCn-gTP7taOVg 2026-08-01 14:00:04+00:00| seen|...
BELL-CVE-2026-64476
Bulletin has no description...
Security update for the Linux Kernel (Live Patch 25 for SUSE Linux Enterprise 15 SP6)
This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.109 fixes various security issues: The following security issues were fixed: CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060...
CVE-2026-17433 nanocoai NanoClaw MCP Server Approval chat-sdk-bridge.ts createChatSdkBridge.setup improper authorization
A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of the file src/channels/chat-sdk-bridge.ts of the component MCP Server Approval. Performing a manipulation results in improper authorization. The attack needs to be approached...
DEBIAN-CVE-2026-64493
In the Linux kernel, the following vulnerability has been resolved: iio: pressure: mpl115: fix runtime PM leak on read error mpl115readraw takes a runtime PM reference with pmruntimegetsync before reading the processed pressure or raw temperature, but on the read error path it returns without...
EUVD-2026-48763
Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ DNS-over-QUIC receive path...
CVE-2026-65512
Cross-Site request forgery CSRF vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This issue affects WP Activity Log: through 5.6.4; WP Activity Log Premium: through 5.6.4...
EUVD-2026-48118
Unauthenticated Cross Site Request Forgery CSRF in WP Activity Log = 5.6.4 versions...
CVE-2026-16492
CVE-2026-16492 affects the umijs umi project up to version 4.6.63, specifically the GIT File Helper’s function git.getFileCreateInfo in the file packages/utils/src/getFileGitIno.ts . This manipulation enables an OS command injection, with a public exploit available. A fix is provided in version 4...