10848 matches found
CVE-2026-11870
The WP Ghost Hide My WP Ghost WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before trusting attacker-controllable HTTP headers, allowing unauthenticated attackers to spoof their IP address to bypass the WP Ghost Hide My WP Ghost WordPress...
CVE-2026-58066
Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside...
CVE-2026-58066
Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside...
CVE-2026-11870 Hide My WP Ghost < 7.0.05 - IP Address Spoofing via Trusted Proxy Headers Leading to Protection Mechanism Bypass
The WP Ghost Hide My WP Ghost WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before trusting attacker-controllable HTTP headers, allowing unauthenticated attackers to spoof their IP address to bypass the WP Ghost Hide My WP Ghost WordPress...
CVE-2026-11870
The WP Ghost (Hide My WP Ghost) WordPress plugin versions prior to 7.0.05 is vulnerable to an IP Address Spoofing attack. The root cause is the plugin's failure to verify that client IP information originates from a trusted proxy before accepting attacker-controllable HTTP headers. This oversight...
CVE-2026-11870 Hide My WP Ghost < 7.0.05 - IP Address Spoofing via Trusted Proxy Headers Leading to Protection Mechanism Bypass
The WP Ghost Hide My WP Ghost WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before trusting attacker-controllable HTTP headers, allowing unauthenticated attackers to spoof their IP address to bypass the WP Ghost Hide My WP Ghost WordPress...
The vulnerability of the automatic update mechanism of PC ViPNet administrators, related to deficiencies in handling relative paths, allows a perpetrator from a neighboring trusted network to compromise the integrity of the operating environment of the target node by using a specially crafted update package, delivered from a compromised trusted node with the role of Network Management Center (NMC).
The vulnerability of the automatic update mechanism of PC ViPNet Administrator is related to deficiencies in the processing of relative paths. Exploiting this vulnerability can allow a perpetrator operating from a neighboring trusted network to compromise the integrity of the operating environmen...
kernel security, bug fix, and enhancement update
5.14.0-687.31.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...
CVE-2026-2482
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...
CVE-2026-18257 Improper Certificate Validation in S2OPC
Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to be considered trusted...
CVE-2026-18257
Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to be considered trusted...
PT-2026-65868
Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 Description Cross-site request forgery allows an attacker to execute malicious and unauthorized actions by transmitting requests from a user that the website trusts...
Check Point Gaia Operating System (sk185169)
The remote host is missing a hotfix for the Gaia Operating System. It is, therefore, affected by a vulnerability as referenced in the sk185169 advisory. - An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an...
CVE-2026-18257: Improper Certificate Validation
Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to be considered trusted...
PT-2026-65843
Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of S2OPC allows a certificate issued by this root issuer to be considered trusted...
NewStart CGSL MAIN 6.06 : containerd.io Vulnerability (NS-SA-2026-0060)
The remote NewStart CGSL host, running version MAIN 6.06, has containerd.io packages installed that are affected by a vulnerability: - containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User se...
Check Point Gaia Operating System (sk185152)
The remote host is missing a hotfix for the Gaia Operating System. It is, therefore, affected by a vulnerability as referenced in the sk185152 advisory. - An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remot...
Security Bulletin: Vulnerability in the TS3100/TS3200 Web User Interface could allow unauthorized library access (CVE-2011-1372)
Abstract Administrative access to the library may be obtained without supplying proper credentials. Content Security Bulletin: Vulnerability in the TS3100/TS3200 Web User Interface could allow unauthorized library access CVE-2011-1372 SUMMARY: Administrative access to the library may be obtained...
Rapid7 Analysis: Check Point SmartConsole Authentication Bypass (CVE-2026-16232)
Overview On July 22, 2026, Check Point published a security advisory for CVE-2026-16232, an authentication bypass in the SmartConsole login process affecting Security Management Server and Multi-Domain Security Management Server MDS. By leveraging CVE-2026-16232, an unauthenticated attacker can...
