112620 matches found
CVE-2026-28002 WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22...
EUVD-2026-57910
Author Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...
CVE-2026-66458
Unauthenticated SQL Injection in RealPress = 1.1.2 versions...
CVE-2026-65582
Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...
EUVD-2026-57962
Subscriber SQL Injection in Form Maker by 10Web = 1.15.44 versions...
EUVD-2026-57959
Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...
CVE-2026-28149
The CVE-2026-28149 entry covers an Unauthenticated PHP Object Injection in the WordPress Headless Single Sign On plugin versions <= 1.6. The underlying issue is a PHP object injection vulnerability that can be exploited without authentication, leading to high impact on confidentiality, integri...
EUVD-2026-57853
Heap buffer overflow in PostgreSQL pgdump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pgdump, via a crafted transform list. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...
CVE-2026-14680
Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for...
EUVD-2026-57842
Buffer over-read in PostgreSQL pgtrgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...
CVE-2026-73620 GitPython before 3.1.57 Arbitrary File Overwrite and Read
GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout and TagReference.create, allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band...
UBUNTU-CVE-2026-19695
Gammu DCT3 trace file parser crash in 4.6.0 to 4.6.7 allows denial of service...
XWiki Platform - Remote Code Execution
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Improper escaping in the document SkinsCode.XWikiSkinsSheet leads to an injection vector from view right on that document to programming rights, or in other words, it is possible to execute...
PT-2026-71602
Unauthenticated Broken Access Control in GiveWP 4.16.6 versions...
OPENSUSE-SU-2026:11509-1 python3-ansible-compat-26.8.0-1.1 on GA media
These are all security issues fixed in the python3-ansible-compat-26.8.0-1.1 package on the GA media of openSUSE Tumbleweed...
CVE-2026-46382 Meeting Room Booking System has server-side request forgery in import functionality
The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...
CVE-2026-59844 affecting package libssh for versions less than 0.10.6-9
CVE-2026-59844 affecting package libssh for versions less than 0.10.6-9. A patched version of the package is available...
CVE-2026-63964 affecting package kernel for versions less than 6.6.144.1-2
CVE-2026-63964 affecting package kernel for versions less than 6.6.144.1-2. A patched version of the package is available...