115909 matches found
CVE-2026-24964 WordPress Contest Gallery plugin <= 28.1.2.1 - Server Side Request Forgery (SSRF) vulnerability
Server-Side Request Forgery SSRF vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Server Side Request Forgery.This issue affects Contest Gallery: from n/a through = 28.1.2.1...
CVE-2026-24370 WordPress The Grid plugin <= 2.8.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeOne The Grid allows Stored XSS. This issue affects The Grid: from n/a through 2.8.0...
CVE-2026-23977
CVE-2026-23977 concerns the WordPress plugin WPFactory Helpdesk Support Ticket System for WooCommerce (up to and including version 2.1.2). The issue is a Broken Access Control vulnerability caused by incorrectly configured access control security levels, allowing unauthorized access. Public data ...
CVE-2026-22509 WordPress Gioia theme <= 1.4 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Elated-Themes Gioia gioia allows PHP Local File Inclusion.This issue affects Gioia: from n/a through = 1.4...
CVE-2026-22507 WordPress Beelove theme <= 1.2.6 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in AncoraThemes Beelove beelove allows Object Injection.This issue affects Beelove: from n/a through = 1.2.6...
CVE-2026-22448
PitchPrint WordPress plugin (flexcubed PitchPrint) <= 11.1.2 is reported to have an improper pathname restriction (path traversal) vulnerability that enables unauthenticated deletion of arbitrary files. The CVE entry CVE-2026-22448 and related Red Hat/ENISA/CVE references confirm affected vers...
EUVD-2026-15410
A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through...
EUVD-2026-15404
When a certificate and its private key are installed in the Windows machine certificate store using Network and Security tool, access rights to the private key are unnecessarily granted to the operator group. Installations based on Panorama Suite 2025 25.00.004 are vulnerable unless...
CVE-2026-3215
The Drupal Islandora digital asset management framework is vulnerable to Cross-Site Scripting (XSS) in versions prior to 2.17.5 . The root cause is the insufficient sanitization of URI paths within a custom route used for attaching media to nodes. An attacker with the "create media" permission an...
CVE-2026-3212 Tagify - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-013
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Tagify allows Cross-Site Scripting XSS.This issue affects Tagify: from 0.0.0 before 1.2.49...
CVE-2026-3210 Material Icons - Moderately critical - Access bypass - SA-CONTRIB-2026-011
Incorrect Authorization vulnerability in Drupal Material Icons allows Forceful Browsing.This issue affects Material Icons: from 0.0.0 before 2.0.4...
DEBIAN-CVE-2026-1519
If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries see:...
CVE-2026-1519
If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries see:...
CVE-2026-4760 Potential unauthorized access to files on the Web HMI server host
From Panorama Web HMI, an attacker can gain read access to certain Web HMI server files, if he knows their paths and if these files are accessible to the Servin process execution account. Installations based on Panorama Suite 2022-SP1 22.50.005 are vulnerable unless update PS-2210-02-4079 or high...
BIT-MARIADB-2026-32710 Heap-based Buffer Overflow in MariaDB
MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSONSCHEMAVALID function. Under certain conditions it might be possible to turn the crash into a remote code execution. These...
Exploit for CVE-2024-51324
CVE-2024-51324 — BYOVD: BdApiUtil64.sys Process Killer · Maste...
CVE-2026-26306
The installer for OM Workspace Windows Edition Ver 2.4 and earlier insecurely loads Dynamic Link Libraries DLLs, which could allow an attacker to execute arbitrary code with the privileges of the user invoking the installer...
EUVD-2026-15171
A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to modify protected parts of the file system...
EUVD-2026-15099
A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access sensitive user data...
CVE-2026-28892
A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to modify protected parts of the file system...