26730 matches found
CVE-2026-60175
creationtimestamp| type| source ---|---|--- 2026-07-23 16:47:21+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...
CVE-2026-65916
CyberPanel up to version 1.9.1 contains a missing authorization vulnerability in the cancelBackupCreation handler. An authenticated user can send crafted POST requests with arbitrary backupCancellationDomain and fileName parameters to terminate backup processes, delete backup archives, corrupt ba...
MINI-2CVG-2PFM-G4CR
Bulletin has no description...
CVE-2026-59544
creationtimestamp| type| source ---|---|--- 2026-07-23 13:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrcvlzdlq22s...
CVE-2026-59543
creationtimestamp| type| source ---|---|--- 2026-07-23 13:02:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrcvii4pva2q...
PYSEC-2026-3475 LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection
Summary When LightRAG is deployed with LIGHTRAGAPIKEY set but AUTHACCOUNTS unset an officially documented "API-Key authentication" mode, the X-API-Key protection can be bypassed by any remote unauthenticated attacker. The bypass does not require network contact with the victim server — an attacke...
CVE-2026-15448
Tickera – Sell Tickets & Manage Events (WordPress) is vulnerable to a generic SQL Injection via the tc_order_status_filter parameter in all versions up to 3.6.0.1, caused by insufficient escaping of user input and inadequate preparation of the existing SQL query. Authenticated attackers with staf...
CVE-2026-15448 Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_order_status_filter' Parameter
The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tcorderstatusfilter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...
CVE-2026-9577
The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the mod URL parameter before reflecting it into the admin settings page admin.php?page=post-status-notifier-lite, leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's sessi...
CVE-2026-9577 Post Status Notifier Lite < 1.13.0 - Reflected XSS via mod Parameter
The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the mod URL parameter before reflecting it into the admin settings page admin.php?page=post-status-notifier-lite, leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's sessi...
CVE-2026-9577
The Post Status Notifier Lite WordPress plugin (versions before 1.13.0 ) contains a Reflected Cross-Site Scripting (XSS) vulnerability. The flaw exists because the plugin fails to properly escape the mod URL parameter before reflecting it onto the admin settings page at admin.php?page=post-status...
CVE-2026-16560
creationtimestamp| type| source ---|---|--- 2026-07-23 05:55:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116967742251184999...
CVE-2026-16631
creationtimestamp| type| source ---|---|--- 2026-07-23 01:46:33+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrbpqjfxpt24...
[SECURITY] Fedora 44 Update: nginx-mod-vts-0.2.4-13.fc44
Nginx virtual host traffic status module...
PT-2026-63790
The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc order status filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-9577: Improper Neutralization of Input During Web Page Generation
The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the mod URL parameter before reflecting it into the admin settings page admin.php?page=post-status-notifier-lite, leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's sessi...
PT-2026-63576
The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the mod URL parameter before reflecting it into the admin settings page admin.php?page=post-status-notifier-lite, leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's sessi...
PT-2026-64004
Name of the Vulnerable Software and Affected Versions dovecot versions prior to 2.4.5-1.1 Description An attacker with valid credentials can cause a denial of service for IMAP by selecting a compression algorithm for the connection that requires excessive memory for its decompression state. By...