691 matches found
Astra Linux – Vulnerability in libde265
libde265 v1.0.4 contains a heap buffer overflow vulnerability in the mmloadlepi64 function, which can be exploited through a specially crafted file...
PT-2026-89439
Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions...
EUVD-2026-54224
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the PIN-type challenge throttle uses emailHash as the only key. The throttle rows live in the central challengethrottle table, which is shared across all tenants...
CVE-2026-48071
OpenReception's appointment booking software (prior to version 1.0.4) has a vulnerability in the PIN-type challenge throttle. The throttle uses emailHash as the single key, with throttle rows stored in a shared central challenge_throttle table across tenants. As a result, failing challenges in on...
CVE-2026-48071 OpenReception's client PIN challenge throttle is keyed by emailHash only, allowing cross-tenant lockout
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the PIN-type challenge throttle uses emailHash as the only key. The throttle rows live in the central challengethrottle table, which is shared across all tenants...
CVE-2026-18915 Exposure of OTP Secret Through Process Command-Line Arguments in TÜBİTAK BİLGEM's eta-otp-lock
Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting. This issue affects eta-otp-lock: before 1.0.4...
WordPress Huge IT Login plugin <= 1.0.4 - Unauthenticated Account Takeover vulnerability
Unauthenticated Account Takeover vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Login Social versions = 1.0.4...
CLSA-2026-1784682965 TuxCare security update for debug (1 CVE)
TuxCare rebuilt debug to address 1 CVE. Fixed in 1.0.4-tuxcare.1...
CLSA-2026-1782781172 TuxCare security update for tmpl (1 CVE)
TuxCare rebuilt tmpl to address 1 CVE. Fixed in 1.0.4-tuxcare.1...
CLSA-2026-1779670116 TuxCare security update for cipher-base (1 CVE)
TuxCare rebuilt cipher-base to address 1 CVE. Fixed in 1.0.4-tuxcare.1...
EUVD-2026-52668
External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Client Functionality. This issue affects pardus-image-writer: before 1.0.4...
CVE-2026-18642
Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...
CVE-2026-18642 Remote Code Execution via Insecure Deserialization in TÜBİTAK BİLGEM's eta-otp-lock
Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...
CVE-2026-54722
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, isurlsafe in src/helpers.ts strips the @ userinfo delimiter with removeatsymbolinstring before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP...
CVE-2026-54722 dssrf: there a critical security bug with remove_at_symbol_in_string
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, isurlsafe in src/helpers.ts strips the @ userinfo delimiter with removeatsymbolinstring before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP...
CVE-2026-54722
DSSRF (Node.js library) has a vulnerability in is_url_safe prior to version 1.0.4. The bug arises because is_url_safe strips the @ userinfo delimiter via remove_at_symbol_in_string before parsing URLs, allowing an attacker-controlled URL to bypass internal-IP validation and cause a client using t...
CVE-2026-57427
Unauthenticated Cross Site Scripting XSS in Download Monitor - WPForms Lock = 1.0.4 versions...
EUVD-2026-48169
Unauthenticated Cross Site Scripting XSS in Download Monitor - WPForms Lock = 1.0.4 versions...
CVE-2026-57427 WordPress Download Monitor - WPForms Lock plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Download Monitor - WPForms Lock = 1.0.4 versions...