50420 matches found
CVE-2026-15025
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.3.2 via the automatorgooglecontactsfetchlabels, automatormauticsegmentfetch, automatormautictagsfetch, and...
BIT-THRIFT-2026-48144 Apache Thrift: c_glib TLS Client Missing Hostname Verification
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...
CVE-2026-15014 SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the billingphone parameter. This is due to the processRegistration...
EUVD-2026-49666
Unauthenticated Cross Site Scripting XSS in miniorange otp verification = 5.5.1 versions...
PT-2026-65521
Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and...
PT-2026-65403
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the billing phone parameter. This is due to the processRegistration...
Linux Distros Unpatched Vulnerability : CVE-2026-55953
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered ...
OpenSSL 3.5.0 < 3.5.5 Multiple Vulnerabilities in SANnav images
Brocade SANnav has provided security updates to multiple vulnerabilities as referenced in the 3.5.5 advisory and as described in the Nessus Plugin ID 296768 - Issue summary: If an application using the SSLCIPHERfind function in a QUIC protocol client or server receives an unknown cipher suite fro...
CVE-2026-61957
Unauthenticated Cross Site Scripting XSS in miniorange otp verification = 5.5.1 versions...
CVE-2026-61957 WordPress miniorange otp verification plugin <= 5.5.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in miniorange otp verification = 5.5.1 versions...
EUVD-2026-49595
In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetrickeys - fix OOB read in pefiledigestpecontents pefiledigestpecontents computes the trailing-data hash length as pelen - hashedbytes + certssize. A crafted PE can make the addition exceed pelen, causing the unsign...
EUVD-2026-49406
A flaw was found in the Event-Driven Ansible EDA server. The ExternalEventStreamViewSet uses permissive access controls permissionclasses=AllowAny, authenticationclasses= and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a...
OSEC-2026-12 AEAD `decrypt_into` functions writes plaintext before checking the tag
On the generic GCM path, AES.GCM.authenticatedecryptinto as well as Chacha20.authenticatedecryptinto and AES.CCM16.authenticatedecryptinto writes the decrypted plaintext into the caller's destination buffer and only then compares the tag. On a forged tag the function returns false, but the...
CVE-2026-55953
The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tlshandshake:hello/5 handler validates the negotiated protocol version and the downgrade...
DEBIAN-CVE-2026-55953
The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tlshandshake:hello/5 handler validates the negotiated protocol version and the downgrade...
UBUNTU-CVE-2026-55953
The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tlshandshake:hello/5 handler validates the negotiated protocol version and the downgrade...
EUVD-2026-49332
phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers that allows administrators with only group-management permissions to join privileged groups without verification of required rights. Attackers can add themselves to pre-existing groups holding...
CVE-2026-55953 TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication
The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tlshandshake:hello/5 handler validates the negotiated protocol version and the downgrade...
Improper Validation of Certificate with Host Mismatch
Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch in the TLS client implementation due to missing hostname verification. An attacker can intercept or manipulate encrypted communications by presenting a certificate for a different...
