8821 matches found
CVE-2026-6972
The SKT Skill Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the chartsize attribute of the skillwrapper shortcode in all versions up to, and including, 2.6. This is due to insufficient input sanitization and output escaping on the chartsize attribute, which is...
CVE-2026-64578 ksmbd: validate compound request size before reading StructureSize2
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate compound request size before reading StructureSize2 When ksmbd validates a compound chained SMB2 request, ksmbdsmb2checkmessage reads pdu-StructureSize2 without first checking that the compound element is large...
CVE-2026-4431 Easy Post Submission <= 2.3.0 - Missing Authorization
The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createpost function in all versions up to, and including, 2.3.0. This is due to the rbsmsubmitpost AJAX action being registered for unauthenticated users via...
CVE-2026-7441 Simple Yearly Archive <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the posttype attribute of the SimpleYearlyArchive shortcode in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This make...
CVE-2026-6972 SKT Skill Bar <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
The SKT Skill Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the chartsize attribute of the skillwrapper shortcode in all versions up to, and including, 2.6. This is due to insufficient input sanitization and output escaping on the chartsize attribute, which is...
EUVD-2026-53175
The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraphaccelprep' parameter in versions up to, and including, 2.29.15. This is due to the CacheExtractPreparePageParams function using PHP's loose inequality operator != to compare the expecte...
CVE-2026-18817
CVE-2026-18817 affects Baserow up to 2.3.2. The issue involves the function BaserowImpersonateAuthTokenSerializer in backend/src/baserow/api/admin/users/serializers.py (Inactive Non-Staff User Handler). A manipulation may lead to improper authorization and, per the report, remote exploitation is ...
CVE-2026-47682
CVAT contains a path-containment validation flaw in versions 1.6.0–2.64.0. An attacker with write access to a cloud storage added to a CVAT instance, or the ability to add new cloud storages, can overwrite arbitrary files on the server filesystem. The issue enables arbitrary path writes at multip...
UBUNTU-CVE-2026-47781
PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code befo...
Use After Free
Overview Affected versions of this package are vulnerable to Use After Free in the HTTP/2 handling process when nghttp2sessionmemsend is called re-entrantly during the execution of nghttp2sessionmemrecv. An attacker can cause a heap-use-after-free condition by triggering concurrent or re-entrant...
WordPress SKT Skill Bar plugin <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin SKT Skill Bar versions = 2.6...
CLSA-2026-1785380226 TuxCare security update for org.springframework.amqp (2 CVEs)
TuxCare rebuilt 4 org.springframework.amqp packages to address 2 CVEs. Fixed in 2.1.8.RELEASE-tuxcare.1...
CLSA-2026-1784943288 TuxCare security update for form-data (1 CVE)
TuxCare rebuilt form-data to address 1 CVE. Fixed in 2.1.4-tuxcare.2...
CLSA-2026-1784856439 TuxCare security update for dompurify (2 CVEs)
TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.4.7-tuxcare.4...
CLSA-2026-1784769502 TuxCare security update for svelte (1 CVE)
TuxCare rebuilt svelte to address 1 CVE. Fixed in 2.16.1-tuxcare.2...
CLSA-2026-1784682960 TuxCare security update for svgo (1 CVE)
TuxCare rebuilt svgo to address 1 CVE. Fixed in 2.8.0-tuxcare.2...
CLSA-2026-1784682913 TuxCare security update for twig/twig (10 CVEs)
TuxCare rebuilt twig/twig to address 10 CVEs. Fixed in v2.15.6-p2+tuxcare...
CLSA-2026-1784596288 TuxCare security update for connect (1 CVE)
TuxCare rebuilt connect to address 1 CVE. Fixed in 2.12.0-tuxcare.1...