EUVD-2026-74842

PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expireafterviews limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the...

CVE-2026-87816 PasswordPusher before 2.11.1 Race Condition View Limit Bypass

PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expireafterviews limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the...

CVE-2026-19778

The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to time-based SQL Injection via the 'feed' parameter in all versions up to, and including, 2.23.7 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-19778 WPMR Google Feed Manager for WooCommerce <= 2.23.7 - Authenticated (Administrator+) SQL Injection via 'feed' Parameter

The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to time-based SQL Injection via the 'feed' parameter in all versions up to, and including, 2.23.7 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-19778

CVE-2026-19778 affects the WPMR Google Feed Manager for WooCommerce plugin for WordPress in all versions up to and including 2.23.7 . The vulnerability is a time-based SQL Injection in the feed parameter, caused by insufficient escaping on the user-supplied parameter and lack of sufficient prepar...

CVE-2026-19778 WPMR Google Feed Manager for WooCommerce <= 2.23.7 - Authenticated (Administrator+) SQL Injection via 'feed' Parameter

The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to time-based SQL Injection via the 'feed' parameter in all versions up to, and including, 2.23.7 due to insufficient escaping on the user supplied parameter and lack of...

EUVD-2026-74757

The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to time-based SQL Injection via the 'feed' parameter in all versions up to, and including, 2.23.7 due to insufficient escaping on the user supplied parameter and lack of...

SUSE CVE-2026-20909

Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries...

SUSE CVE-2026-55678

Arc is an open, SQL-native time-series database for telemetry. From 26.02.1 until 26.06.2, Arc Enterprise clustering accepts cluster join requests without authentication when cluster.enabled is true but cluster.sharedsecret is not configured. The defaults in internal/config/config.go set...

SUSE CVE-2026-55785

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in internal/sbi/processor/ueauthentication.go with ordinary equality helpers. Auth5gAkaComfirmRequestProcedure compares RES and XRES with...

CVE-2026-71614

An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the src/mediatools/dvbmpe.c, descriptorTimeslicefecidentifier and gfm2tsipdatagramreader components. Fixed in 0e4093392e1f847c90d20e031e893cd942fef938...

PT-2026-88954

PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expire after views limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the...

CVE-2026-71614

The GPAC multimedia framework (version c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 ) contains a vulnerability that allows an attacker to achieve arbitrary code execution . The flaw resides in the src/media_tools/dvb_mpe.c file, specifically within the descriptorTime_slice_fec_identifier() and gf_m2t...

CVE-2024-58382: Inefficient Algorithmic Complexity

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...

CVE-2026-19778: Improper Neutralization of Special Elements used in an SQL Command

The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to time-based SQL Injection via the 'feed' parameter in all versions up to, and including, 2.23.7 due to insufficient escaping on the user supplied parameter and lack of...

EUVD-2026-75128

An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the src/mediatools/dvbmpe.c, descriptorTimeslicefecidentifier and gfm2tsipdatagramreader components. Fixed in 0e4093392e1f847c90d20e031e893cd942fef938...

PT-2026-88887

The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to time-based SQL Injection via the 'feed' parameter in all versions up to, and including, 2.23.7 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-71614

An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the src/mediatools/dvbmpe.c, descriptorTimeslicefecidentifier and gfm2tsipdatagramreader components. Fixed in 0e4093392e1f847c90d20e031e893cd942fef938...

Deep-Live-Cam v2.7.5-Ultimate

Deep-Live-Cam 2.1.6 Real-time face swap and video deepfake with a single click and only a single image. Disclaimer This deepfake software is designed to be a productive tool for the AI-generated media industry. It can assist artists in animating custom characters, creating engaging content, and...

phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery

The pure-PHP X25519 scalar multiplication in phpseclib is not constant-time. Field addition and subtraction each perform a data-dependent conditional modular reduction, so the cost of each Montgomery-ladder step is a linear function of that step's reduction count which is a quantity determined by...