50412 matches found
CVE-2026-77235
FreeRTOS-Kernel versions prior to 11.3.1 contain a missing privilege verification in the secure context cleanup handler (SecureContext_FreeContext). A local attacker with low privileges can trigger a use-after-free condition in secure-world memory through the SVC handler for secure context deallo...
EUVD-2026-64013
Missing privilege verification in the secure context cleanup handler in FreeRTOS-Kernel before 11.3.1 might allow local users to cause a use-after-free condition in secure-world memory via the SVC handler for secure context deallocation. To remediate this issue, users should upgrade to...
CVE-2026-15046
The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link CSRF...
CVE-2026-15150
The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a...
kbd security update
An update is available for kbd. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kbd packages provide tools for managing console behavior on a Linux system,...
EUVD-2026-63910
The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment...
CVE-2026-15150 myCred < 3.2.5 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification in buyCRED
The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a...
EUVD-2026-63909
The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a...
CVE-2026-15150
The myCred WordPress plugin before 3.2.5 contains an unauthenticated payment bypass in the buyCRED function. The plugin fails to verify that the receiver of an incoming payment gateway notification (e.g., PayPal IPN) matches the site's configured merchant account. An unauthenticated attacker can ...
EUVD-2026-63908
The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link CSRF...
WordPress User Verification plugin <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDOR vulnerability
Unauthenticated Arbitrary Account Lockout via IDOR vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin User Verification versions = 2.0.47...
CVE-2026-16962 Tamara Checkout <= 1.9.9.20 - Unauthenticated Order Status Manipulation
The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs, changing a WooCommerce order's status based solely on an attacker-supplied numeric order id, so an unauthenticated attacker can cancel or...
openssl: OpenSSL: Memory leak leads to Denial of Service in OCSP response checking
A flaw was found in OpenSSL. A malicious TLS Transport Layer Security server can exploit this vulnerability by sending a specially crafted OCSP Online Certificate Status Protocol response during the X.509 certificate chain verification process. This can lead to a memory leak in client application...
SUSE CVE-2026-75589
Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two...
EUVD-2026-63688
Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network...
Kibana 9.4.x < 9.4.4 Privilege Escalation (ESA-2026-83)
The version of Kibana installed on the remote host is 9.4.x prior to 9.4.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-83 advisory. - Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature...
VulnCheck KEV: CVE-2026-15981
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mosamlvalidatesignature function performing a loose boolean check on the raw tri-state integer returned by PHP's opensslverify, causing a...
CVE-2026-62834
Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-72861
The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || await verify...", so when the...
EUVD-2026-63579
The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || await verify...", so when the...