207785 matches found
CVE-2026-85682
The YOP Poll plugin for WordPress (versions up to and including 7.0.10 ) is vulnerable to an Origin Validation Error . The root cause is the plugin transmitting a wp_rest nonce to window.opener via postMessage() using a wildcard targetOrigin . This allows an unauthenticated attacker to steal a RE...
CVE-2026-85682 YOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route
The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wprest nonce to window.opener via postMessage with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to ste...
CVE-2026-11744
An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's web view interface. A local attacker with physical access to t...
EUVD-2026-85813
An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's web view interface. A local attacker with physical access to t...
CVE-2026-48205
A flaw was found in the Apache Camel DNS component. An unauthenticated remote attacker could exploit an improper input validation vulnerability by manipulating DNS operation parameters in HTTP message headers. This allows the attacker to perform a Server-Side Request Forgery SSRF attack,...
PT-2026-98113
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu component where the fw pri buf PSP private buffer was handled using open-coded memset and memcpy operations without proper validation. The fix involves...
CVE-2026-93244
In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: simpledrm: Improve stride validation Validate the computed stride against the maximum value INTMAX...
CVE-2026-93244: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: simpledrm: Improve stride validation Validate the computed stride against the maximum value INTMAX...
PT-2026-104947
In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: simpledrm: Improve stride validation Validate the computed stride against the maximum value INT MAX...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124495)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124495 advisory. Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly...
CVE-2026-91132: Origin Validation Error
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowediframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched...
CVE-2026-17503: Improper Input Validation
IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition firmware runtime boot configuration. An attacker with root access to a partition can maliciously alter...
CVE-2026-17413: Improper Validation of Array Index
IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the RTAS firmware-to-OS interface. An attacker with administrator-level root access to a logical partition can send a...
CVE-2026-77707: Improper Certificate Validation
Improper certificate validation vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle AiTM. This issue affects Liman Render Engine: from 1.0 before 1.2-75...
CVE-2026-93291: Improper Certificate Validation
Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to execute arbitrary code...
CVE-2026-82157: Improper Certificate Validation
Dell ThinOS 10, versions prior to SecurityAddon2605.10.2766T10, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Protection mechanism bypass and Unauthorized access...
CVE-2026-57177: Cross-Site Request Forgery (CSRF)
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to...
CVE-2026-97155: Origin Validation Error
Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict which web origins may invoke its functions by default. The registry value VALIDDOMAINS, which limits permitted origins, was optional and empt...
PT-2026-98191
Name of the Vulnerable Software and Affected Versions Python Social Auth versions prior to 5.0.0 Description The partial-pipeline resume mechanism accepts the partial token as a bearer credential without binding it to the browser session that created it. This allows an attacker to initiate an...
CVE-2025-32000: Improper Input Validation
HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or explicitly trusted without sufficient sanitization, malicious actors can leverage this vulnerability...