223 matches found
Gravity SMTP WordPress Plugin - Sensitive Information Exposure
Gravity SMTP WordPress plugin = 2.1.4 contains a sensitive information exposure caused by an unrestricted REST API endpoint at /wp-json/gravitysmtp/v1/tests/mock-data, letting unauthenticated attackers retrieve detailed system configuration data, exploit requires no authentication. id:...
CLSA-2026-1776818216 TuxCare security update for form-data (1 CVE)
TuxCare rebuilt form-data to address 1 CVE. Fixed in 2.1.4-tuxcare.1...
CLSA-2026-1773015270 TuxCare security update for hosted-git-info (1 CVE)
TuxCare rebuilt hosted-git-info to address 1 CVE. Fixed in 2.1.4-tuxcare.1...
UBUNTU-CVE-2026-69152
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memo...
CVE-2026-64863
Summary: CVE-2026-64863 affects goshs, a single-binary file server. Prior to version 2.1.4, the httpserver/server.go wdGuard treated WebDAV MOVE as a write operation without enforcing --no-delete, allowing WebDAV clients to delete or overwrite files by MOVE with Overwrite: T. This could enable un...
CVE-2026-64863 goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issu...
CVE-2026-62325 goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)
goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allow...
PT-2026-65624
Name of the Vulnerable Software and Affected Versions goshs versions prior to 2.1.4 Description In the WebDAV implementation, the wdGuard function in httpserver/server.go incorrectly classifies the MOVE method as a write-only operation. Consequently, it fails to enforce the --no-delete flag...
PT-2026-65623
Name of the Vulnerable Software and Affected Versions goshs versions 2.1.3 through 2.1.3 Description An authentication bypass exists in the SFTP server component when the application is started with a basic authentication string containing a username but an empty password e.g., -b 'admin:', the...
CVE-2024-58356
SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a table's permissions via OVERWRITE does not take effect, a...
CVE-2024-58356 SurrealDB before 2.1.4 Permission Bypass via DEFINE TABLE OVERWRITE
SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a table's permissions via OVERWRITE does not take effect, a...
EUVD-2026-45154
Improper Handling of Insufficient Privileges vulnerability in Apache Accumulo. An authenticated, but low-privileged user without system permissions may issue a remote command to gracefully shutdown system components compaction-coordinator, compactor, gc, manager, monitor, tserver, or sserver,...
PT-2026-60732
Name of the Vulnerable Software and Affected Versions Apache Accumulo versions 2.1.4 through 2.1.5 Description An authenticated user with low privileges and no system permissions can issue a remote command to gracefully shut down system components, including the compaction-coordinator, compactor,...
CVE-2026-57424
Missing Authorization vulnerability in knitpay Razorpay Payment Links for WooCommerce rzp-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Razorpay Payment Links for WooCommerce: from n/a through = 2.1.4...
CVE-2026-57413
CVE-2026-57413 describes a Server-Side Request Forgery (SSRF) vulnerability in the WordPress plugin “Instant Image Generator” (ai-image). The connected documents indicate the issue affects Instant Image Generator versions from n/a up to 2.1.4. The available details specify the vulnerability type ...
EUVD-2026-43074
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions: from 0.0.0 to 2.1.4...
CVE-2026-15079 Login Disable - Moderately critical - Access bypass - SA-CONTRIB-2026-070
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions: from 0.0.0 to 2.1.4...
PYSEC-2026-1866 Amazon Redshift Python Connector vulnerable to SQL Injection
Summary A SQL injection in the Amazon Redshift Python Connector in version 2.1.4 allows a user to gain escalated privileges via schema injection in the getschemas, gettables, or getcolumns Metadata APIs. Users should upgrade to the driver version 2.1.5 or revert to driver version 2.1.3. Impact A...
