1748 matches found
WordPress AI for SEO plugin <= 2.4.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ali Osman ERBAS 0110m4n in WordPress Plugin AI for SEO versions = 2.4.2...
CVE-2026-28183
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
EUVD-2026-53677
A heap-based buffer overflow exists in lib60870-C 2.4.0 in the server-side FileSegment ASDU encoding path. The issue occurs because FileSegmentencode validates only the standalone segment length via FileSegmentGetMaxDataSize and does not verify the residual capacity of the current ASDU frame befo...
CLSA-2026-1784856439 TuxCare security update for dompurify (2 CVEs)
TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.4.7-tuxcare.4...
Malicious code in internallib_v524 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eba59f6d895fdeae2b83c62331fbb87118aa51202fd30ddc351fa43276408a44 The package's main module exports a function command that invokes /bin/bash -c to fetch a script from reverse-shell.sh and pipe it into sh, connectin...
EUVD-2026-51992
Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...
CVE-2026-68581 Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision
Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...
CVE-2026-61536
Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of % completion % blocks and later resolves their importpath field through importlib.importmodule... + getattr... to obtain the callable that...
CVE-2026-61536 Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE
Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of % completion % blocks and later resolves their importpath field through importlib.importmodule... + getattr... to obtain the callable that...
CVE-2026-16971
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...
CVE-2026-16969 DFIR-IRIS Stored XSS in Assets
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...
CLEANSTART-2026-VY64153 Security fixes in dex 2.44.0-r2
Package dex version 2.44.0-r2 fixes 4 vulnerabilities: CVE-2026-33810, CVE-2026-33814, CVE-2026-29181, CVE-2026-32952...
CLEANSTART-2026-BC05591 Security fixes in k8s-sidecar 2.4.0-r0
Package k8s-sidecar version 2.4.0-r0 fixes 10 vulnerabilities: CVE-2026-44431, CVE-2026-44432, ghsa-mf9v-mfxr-j63j, ghsa-qccp-gfcp-xxvc, CVE-2026-3219...
CLEANSTART-2026-TW92291 Security fixes in dex 2.44.0-r1
Package dex version 2.44.0-r1 fixes 2 vulnerabilities: ghsa-78h2-9frx-2jm8, CVE-2026-34986...
CLEANSTART-2026-CS52712 Security fixes in redis 6.2.4-r0
Package redis version 6.2.4-r0 fixes 1 vulnerabilities: CVE-2021-32625...
CLEANSTART-2026-VQ54070 Security fixes in logstash-fips 9.2.4-r2
Package logstash-fips version 9.2.4-r2 fixes 19 vulnerabilities: CVE-2025-61770, CVE-2025-61771, CVE-2025-61772, CVE-2025-61919, CVE-2025-61780...
PT-2026-66448
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the custom attributes function...
K000162672: Apache HTTP Server vulnerability CVE-2026-34356
Security Advisory Description Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue...