115760 matches found
EUVD-2026-58135
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint...
CVE-2026-28002 WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22...
EUVD-2026-57910
Author Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...
CVE-2026-66458
Unauthenticated SQL Injection in RealPress = 1.1.2 versions...
CVE-2026-65582
Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...
EUVD-2026-57962
Subscriber SQL Injection in Form Maker by 10Web = 1.15.44 versions...
EUVD-2026-57959
Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...
CVE-2026-28149
The CVE-2026-28149 entry covers an Unauthenticated PHP Object Injection in the WordPress Headless Single Sign On plugin versions <= 1.6. The underlying issue is a PHP object injection vulnerability that can be exploited without authentication, leading to high impact on confidentiality, integri...
EUVD-2026-57853
Heap buffer overflow in PostgreSQL pgdump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pgdump, via a crafted transform list. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...
CVE-2026-14680
Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for...
EUVD-2026-57842
Buffer over-read in PostgreSQL pgtrgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...
CVE-2026-73620 GitPython before 3.1.57 Arbitrary File Overwrite and Read
GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout and TagReference.create, allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band...
UBUNTU-CVE-2026-19695
Gammu DCT3 trace file parser crash in 4.6.0 to 4.6.7 allows denial of service...
@dreamguyxeon/baileyx (>=1.0.0, <=5.0.0), @rishi56/baileys (1.0.0) +2 more potentially affected by unknown CVE via @dgxeon13/libsignal-node (1.0.0)
@dgxeon13/libsignal-node NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @dgxeon13/libsignal-node and may be impacted: - @dreamguyxeon/baileyx =1.0.0, =1.0.0, =1.0.2 - sayan-soket 1.0.0 Source cves: unknown CVE Source advisory:...
PT-2026-71575
Unauthenticated Broken Access Control in Arvow AI SEO Writer = 1.5.3 versions...
OPENSUSE-SU-2026:11509-1 python3-ansible-compat-26.8.0-1.1 on GA media
These are all security issues fixed in the python3-ansible-compat-26.8.0-1.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-71602
Unauthenticated Broken Access Control in GiveWP 4.16.6 versions...
CVE-2026-46382 Meeting Room Booking System has server-side request forgery in import functionality
The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...
