22034 matches found
WordPress BetterDocs plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin BetterDocs versions = 4.6.2...
CVE-2026-13464
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...
CVE-2026-62825
CVE-2026-62825 : Azure Key Vault suffers an elevation of privilege due to improper authentication. The entry is reported as a network-based, unauthenticated attack with a CVSS v3.1 base score of 10 (Critical), affecting integrity and availability (I=HIGH, A=HIGH) while confidentiality is None. Th...
AlmaLinux 9 : kernel (ALSA-2026:43307)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:43307 advisory. kernel: crypto: afalg - zero initialize memory allocated via sockkmalloc CVE-2025-71113 kernel: scsi: core: Wake up the error handler when final...
Security update for glib2 (important)
openSUSE security update: security update for glib2 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21410-1 Rating: important References: bsc1270008 bsc1270009 bsc1270010 bsc1270016 bsc1270018 bsc1270021 Cross-References: CVE-2026-58010 CVE-2026-580...
python313-3.13.14-1.1 on GA media (moderate)
python313-3.13.14-1.1 on GA media Announcement ID: openSUSE-SU-2026:11342-1 Rating: moderate Cross-References: CVE-2021-4189 CVE-2025-15366 CVE-2025-15367 CVE-2026-11940 CVE-2026-7210 CVE-2026-8328 CVSS scores: CVE-2021-4189 SUSE : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2025-15366...
NPM: React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)
NPM: React Router: Open redirect via backslash in and useNavigate CVE-2025-68470 bypass vulnerability discovered by ? in WordPress Npm react-router versions = 6.0.0, 7.18.0...
NPM: React Router: Open redirect leading to XSS
NPM: React Router: Open redirect leading to XSS vulnerability discovered by ? in WordPress Npm react-router-dom versions = 6.30.2, = 6.30.4...
CVE-2026-48013
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...
CVE-2026-48013 Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...
CVE-2026-60871
creationtimestamp| type| source ---|---|--- 2026-07-23 17:48:31+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...
CVE-2026-47755 ITFlow Vulnerable to Authenticated Cross-Tenant Credential Disclosure via Unprotected Credential Modal
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can retrieve plaintext credentials and TOTP secrets belonging to another client by directly requesting the credential edit modal wit...
GHSA-5XF7-4P34-54QR pypdf: Possible infinite loop for not terminated inline images
Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. Patches This has been fixed in pypdf==6.14.1. Workarounds If yo...
EUVD-2026-42343
pypdf: Possible large memory usage for wrong image dimensions...
CVE-2026-65606
creationtimestamp| type| source ---|---|--- 2026-07-23 15:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrd43i7i3i2a...
SUSE-SU-2026:22938-1 Security update for runc
This update for runc fixes the following issues: Update to 1.3.6. - CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem integrity violations bsc1268275. Other updates and bugfixes: - Version 1.3.6: Various integration test improvements. When masking directories...
CVE-2026-15037
Improper output neutralization XML injection in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under th...
CVE-2026-65512
Cross-Site request forgery CSRF vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This issue affects WP Activity Log: through 5.6.4; WP Activity Log Premium: through 5.6.4...
openjdk: Improve certification checking (Oracle CPU 2026-07)
A flaw was found in OpenJDK. OpenJDK can apply two different security meanings to the same wildcard dNSName SAN across certificate policy enforcement and hostname verification. During path validation, DNSName.constrains compares .foo.com and secret.foo.com literally and returns NAMESAMETYPE, so...