992 matches found
NPM: fast-uri vulnerable to host confusion via backslash authority introducer
NPM: fast-uri vulnerable to host confusion via backslash authority introducer vulnerability discovered by ? in WordPress Npm fast-uri versions 2.4.4...
CVE-2026-14849
The CVE-2026-14849 entry concerns the Paid Membership Subscriptions WordPress plugin (before 3.0.7). Affected component: member and payment export files written to a predictable location in the uploads directory. Root cause: lack of protection allows unauthenticated users to download these export...
CVE-2026-56852 affecting package skopeo for versions less than 1.14.4-12
CVE-2026-56852 affecting package skopeo for versions less than 1.14.4-12. A patched version of the package is available...
CVE-2026-56852 affecting package sriov-network-device-plugin for versions less than 3.7.0-7
CVE-2026-56852 affecting package sriov-network-device-plugin for versions less than 3.7.0-7. A patched version of the package is available...
CVE-2026-65888
Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox 2.20.2 - The socialLogin method allows actors to login as any given user on the target site...
CVE-2026-65889
Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion 2.20.2 - The generateNewApp method allows actors to recursively delete directories...
CVE-2026-65943
Joomla Extension RO CSVI by rolandd.com (
PT-2026-65806
Joomla Extension - balbooa.com - Payment bypass in Gridbox 2.20.2...
CVE-2026-55973 affecting package unbound for versions less than 1.25.2-1
CVE-2026-55973 affecting package unbound for versions less than 1.25.2-1. An upgraded version of the package is available that resolves this issue...
Astra Linux – Vulnerability in Chromium
Using “after free” in DevTools in Google Chrome before version 150.0.7871.47 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: Low...
CVE-2026-59884 affecting package python-pyasn1 for versions less than 0.4.8-3
CVE-2026-59884 affecting package python-pyasn1 for versions less than 0.4.8-3. A patched version of the package is available...
CVE-2026-15392 affecting package perl-DBI for versions less than 1.651-1
CVE-2026-15392 affecting package perl-DBI for versions less than 1.651-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-59885 affecting package python-pyasn1 for versions less than 0.4.8-3
CVE-2026-59885 affecting package python-pyasn1 for versions less than 0.4.8-3. A patched version of the package is available...
Plone RestrictedPython < 5.3 / 6.x < 6.1 RCE
The version of RestrictedPython installed on the remote host is prior to 5.3, or 6.x prior to 6.1. It is, therefore, affected by a remote code execution vulnerability due to not checking access to stack frames and their attributes. An authenticated, remote attacker can exploit this to bypass...
CVE-2026-61425 Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0
The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access...
CVE-2026-62236
grav-plugin-login before 3.8.11 contains a CSRF in the login.regenerate2FASecret frontend task, which regenerates and persists a new TOTP secret for the authenticated user without anti-CSRF nonce or Origin/Referer checks. Grav core dispatches the task via a top-level GET using the task: URI param...
CVE-2026-57833 Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2
Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics 5.0.2 - The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS in relation to the AI analysis feature...
Microsoft PC Manager < 3.22.1.0 Elevation of Privilege (CVE-2026-50438) (July 2026)
The Windows 'Microsoft PC Manager' app installed on the remote host is prior to 3.22.1.0. It is, therefore, affected by an elevation of privilege vulnerability: - A local privilege escalation vulnerability allows an authenticated attacker to escalate privileges beyond the vulnerable component's...
CVE-2026-49971 Laravel-Mediable < 7.0.0 Stored XSS via SVG File Upload
Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymous users to execute arbitrary JavaScript by uploading unsanitized SVG files containing embedded scripts in onload event handlers, script tags, or foreignObject elements. Attacker...