150842 matches found
CVE-2026-74251
Unauthenticated SQL Injection via Attribute Filter in Phoca Cart Phoca Cart ≤ 6.1.6 — Unauthenticated Attacker Extracts Full Database via Time-Based Blind Injection SUMMARY The a attribute and s specification GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQ...
PT-2026-87350
Microsoft's Security Advisory CVE-2026-69304 hits ASP․NET Core, a denial of service vulnerability. ASP․NET Core's MEV IValidationMessageFormatter is superseded by ValidationAttribute․FormatMessage, which the BCL now provides. The interface gets dropped in favor of the base class method. F ships n...
PT-2026-86991
Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...
PT-2026-86963
SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the vict...
PT-2026-87199
A new vulnerability with increased severity was disclosed for Microsoft Windows CVE-2026-58599 https://t.co/KnKmDk7lXz...
Linux Distros Unpatched Vulnerability : CVE-2026-57099
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. CVE-2026-57099 Note that...
PT-2026-87692
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network...
PT-2026-87090
🚨 CRITICAL — CVE-2026-12744 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthentica… CVSS 9.8 🔴 No patch yet Full analysis → https://t.co/BqCC52NTwG Ivanti CyberSecurity InfoSec...
PT-2026-87091
🚨 CRITICAL — CVE-2026-12745 A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthentica… CVSS 9.8 🔴 No patch yet Full analysis → https://t.co/HdDXJJRQ5P Ivanti CyberSecurity InfoSec...
PT-2026-87755
We have just added an important vulnerability affecting Microsoft Windows CVE-2026-69845 https://t.co/ulFX3mqvL1...
PT-2026-86961
@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data...
PT-2026-86950
SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially...
PT-2026-86951
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation coul...
PT-2026-87160
Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform...
PT-2026-87167
An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause the server to expend CPU resources...
EulerOS 2.0 SP12 : libsoup (EulerOS-SA-2026-3353)
According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine...
WordPress Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation vulnerability
Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Event SOlution versions = 4.1.22...
PT-2026-87538
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network...
CVE-2026-79571
CVE-2026-79571 is a critical incorrect access control vulnerability in the SellerAuthorizeAspect component of springboot-project v1.0.0 . Unauthenticated attackers can bypass authorization to access all seller management interfaces, including listing products and orders, putting products on/off s...