30296 matches found
RHEL 8 : kernel-rt (RHSA-2026:23259)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:23259 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements...
PT-2026-47144
Name of the Vulnerable Software and Affected Versions The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress versions prior to 1.8.42 Description Insufficient escaping of user-supplied parameters and lack of proper preparation of SQL queries allow authenticated attackers...
EulerOS Virtualization 2.12.0 : python-virtualenv (EulerOS-SA-2026-2113)
According to the versions of the python-virtualenv package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU...
EulerOS Virtualization 2.13.1 : python-virtualenv (EulerOS-SA-2026-2148)
According to the versions of the python-virtualenv package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU...
CVE-2026-6242
The CVE-2026-6242 entry describes an authenticated format-string vulnerability in the ONVIF Subscribe service of TP-Link Tapo C520WS v2. The root cause is improper handling of externally supplied parameters within formatting functions, enabling an attacker with valid credentials to inject crafted...
CVE-2026-6448 Quiz and Survey Master (QSM) <= 11.1.2 - Authenticated (Admin+) SQL Injection via 'order' and 'limit' Parameters
The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order' parameter in all versions up to, and including, 11.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...
CVE-2026-6448
The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order' parameter in all versions up to, and including, 11.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...
CVE-2026-11422
creationtimestamp| type| source ---|---|--- 2026-06-05 23:20:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnlbojk7yw22...
CVE-2026-46398
creationtimestamp| type| source ---|---|--- 2026-06-05 21:35:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnl3rq4wz32z...
CVE-2025-62319
creationtimestamp| type| source ---|---|--- 2026-06-05 20:37:37+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mnkyjvtcie22 2026-08-22 01:38:04+00:00| seen| https://bsky.app/profile/secqube.com/post/3mtn5axxvck23...
CVE-2026-46392
creationtimestamp| type| source ---|---|--- 2026-06-05 20:00:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnkwj2rvxl2o...
CVE-2025-71215
A time-of-check time-of-use vulnerability in the Trend Micro Apex One mac agent iCore service signature verification could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target...
CVE-2022-23826
A TOCTOU Time-Of-Check to Time-Of-Use in the graphics interface may allow an attacker to load registers repeatedly creating a race condition potentially leading to a loss of integrity...
CVE-2026-43930
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.76 and 9.9.0-alpha.2, a race condition in the MFA SMS one-time password OTP login path allows two concurrent /login requests carrying the same OTP to both succeed and both receive...
CVE-2026-7724
A vulnerability has been found in PrefectHQ prefect up to 3.6.28.dev1. Affected by this vulnerability is the function validaterestrictedurl of the component Webhook/Notification. The manipulation leads to time-of-check time-of-use. It is possible to initiate the attack remotely. The attack is...
CVE-2026-5080
Dancer::Session::Abstract versions through 1.3522 for Perl generates session ids insecurely. The session id is generated from summing the character codepoints of the absolute pathname with the process id, the epoch time and calls to the built-in rand function to return a number between 0 and...
CVE-2026-5085
Solstice::Session versions through 1440 for Perl generates session ids insecurely. The generateSessionID method returns an MD5 digest seeded by the epoch time, a random hash reference, a call to the built-in rand function and the process id. The same method is used in the generateID method in...
CVE-2026-37220
FlexRIC v2.0.0 crashes when an SCTP association is closed before an E2SETUPREQUEST is sent. The near-RT RIC assumes a mapping between SCTP association and E2 node always exists in the cleanup path and enforces this via assert. A remote unauthenticated attacker can crash the near-RT RIC port 36421...
CVE-2026-44459
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values to silently bypass time-based checks. This issue is not...