811 matches found
ROOT-OS-UBUNTU-2204-CVE-2026-23085 CVE-2026-23085 in linux - Patched by Root
Root has patched CVE-2026-23085 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...
CVE-2026-15237 Hotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid...
CVE-2026-28141
Unauthenticated Cross Site Scripting XSS in NextGEN Gallery = 4.2.3 versions...
EUVD-2026-53853
An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue...
CVE-2026-54225
Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update t...
CVE-2026-4431 Easy Post Submission <= 2.3.0 - Missing Authorization
The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createpost function in all versions up to, and including, 2.3.0. This is due to the rbsmsubmitpost AJAX action being registered for unauthenticated users via...
CLSA-2025-1752019395 TuxCare security update for org.apache.kafka (5 CVEs)
TuxCare rebuilt 47 org.apache.kafka packages to address 5 CVEs. Fixed in 3.2.3.tuxcare.1...
CVE-2026-16285
The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment — including private or unlinked uploads — by enumerating its numeric ID...
CLEANSTART-2026-MJ21228 Security fixes in harbor 2.13.4-r2
Package harbor version 2.13.4-r2 fixes 7 vulnerabilities: CVE-2025-55198, CVE-2025-55199, CVE-2026-27141, CVE-2025-53547, ghsa-f9f8-9pmf-xv68...
CVE-2026-15153 WP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via Booking List Search
The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks...
CVE-2026-65558
CVE-2026-65558 concerns the WordPress AffiliateX plugin, affected through version <= 2.3.5, with an unauthenticated Server Side Request Forgery (SSRF) vulnerability. The Patchstack entry characterizes the impact as CVSSv3.1: Network attack vector, high attack complexity, no privileges required...
BIT-OPENBAO-2025-52893 OpenBao May Leak Sensitive Information in Logs When Processing Malformed Data
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 may leak sensitive information in logs when processing malformed data. This is separate from the earlier HCSEC-2025-09 / CVE-2025-4166. Th...
CVE-2026-66143
It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue...
CVE-2026-66144
Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 3.2.3, which fixes this issue by imposing a default maximu...
EUVD-2026-48579
It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue...
EUVD-2026-48427
Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233. This issue affects victor Web: before 7.1...
EUVD-2026-47556
Vulnerability in the Oracle HRMS Norway product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS Norway. While...
EUVD-2026-47554
Vulnerability in the Oracle HRMS UK product of Oracle E-Business Suite component: UK Payroll. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS UK. Successful attacks of...
EUVD-2026-47542
Vulnerability in the Oracle HRMS US product of Oracle E-Business Suite component: US Payroll - General. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS US. Successful...
EUVD-2026-47532
Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Time and Labor...