406970 matches found
CVE-2026-94633
A vulnerability exists in the Apache Thrift Dart bindings (versions before 0.25.0 ) where an unauthenticated remote attacker can trigger a Denial of Service (DoS) condition. The flaw occurs when sending input with inconsistent length parameters , specifically causing the TBinaryProtocol.readMessa...
CVE-2026-59666
The Repasat application is affected by a Cross-Site Scripting (XSS) vulnerability. The flaw exists in the "nomOrigen" parameter located at the "/es/origins/store" endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code within their web browser. No s...
CVE-2026-94634
The Apache Thrift Python bindings are vulnerable to allocation of resources without limits or throttling and initialization of a resource with an insecure default (CWE-770, CWE-1188). Specifically, the Python TJSONProtocol has a string length limit that is disabled by default. This issue affects ...
CVE-2026-59665
The Repasat application is susceptible to a Cross-Site Scripting (XSS) vulnerability. The flaw exists in the "nomMotivo" parameter at the "/es/lostmotives/store" endpoint. Successful exploitation could allow an attacker to deceive a user into executing arbitrary code within their browser. No spec...
CVE-2026-103885
The Apache Directory LDAP API (versions 2.1.0 through 2.1.8 ) contains an Asymmetric Resource Consumption vulnerability. An attacker can cause a Denial of Service (DoS) by submitting specially crafted Telephone Numbers , which leads to indefinite 100% CPU core consumption . This can severely degr...
CVE-2026-103877
The Apache Directory LDAP API is vulnerable to a deserialization of untrusted data flaw (CWE-502) in versions 2.1.0 through 2.1.8 . A rogue or compromised LDAP server, or a pre-TLS Man-in-the-Middle (MITM) attacker, can provide a malicious schema object during a loadSchema() subschema search. Thi...
CVE-2026-59662
The Repasat application is affected by a Cross-Site Scripting (XSS) vulnerability, categorized as CWE-79 . The flaw exists in the "nomCompetidor" parameter at the "/es/competitors/store" endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code within...
CVE-2026-103880
The Apache Directory LDAP API is vulnerable to an Asymmetric Resource Consumption (CWE-405) vulnerability. When storing a password using the bcrypt algorithm with a high cost factor (e.g., 30), the server CPU can be forced to run for hours while checking credentials, leading to a Denial of Servic...
CVE-2026-59664
A Cross-Site Scripting (XSS) vulnerability exists in the Repasat application . The flaw is located in the "nomServicioPrestado" parameter of the "/es/providedservices/store" endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code within their browse...
CVE-2026-103878
The Apache Directory LDAP API versions 2.1.0 through 2.1.8 are vulnerable to a cleartext transmission of sensitive information. The root cause involves a StartTLS extended operation initiated after a Search request has been sent, which can result in data being received in plain text before the TL...
CVE-2026-59663
The Repasat application is susceptible to a Cross-Site Scripting (XSS) vulnerability. The flaw exists in the "nomDelegacion" parameter at the "/es/delegations/store" endpoint. If successfully exploited, an attacker could trick a user into executing arbitrary code within their web browser. No spec...
CVE-2026-104403
The ThimPress LearnPress WordPress plugin (versions up to and including 4.4.9 ) is susceptible to an Authorization Bypass Through User-Controlled Key vulnerability. This flaw arises from incorrectly configured access control security levels , which can lead to Insecure Direct Object References (I...
CVE-2026-95662
The Repasat application is affected by a Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this flaw to trick users into executing arbitrary code within their browsers. The vulnerability specifically involves the "nomCompetidor" parameter at the "/es/competitors/store" endpoint....
CVE-2026-103552
A Stack Overflow vulnerability exists in the Apache Directory LDAP API (versions 1.2.0 to before 1.2.9). An unauthenticated remote attacker can trigger this by submitting a deeply nested search filter before binding with the server. The flaw occurs in the server's decoder, which can lead to an ap...
CVE-2026-59661
The Repasat application contains a Cross-Site Scripting (XSS) vulnerability (CWE-79) affecting the "nomRuta" parameter at the "/es/routes/update/693" endpoint. Successful exploitation allows an attacker to trick a user into executing arbitrary code within their browser. No specific exploit detail...
CVE-2026-59660
The Repasat application is vulnerable to a Cross-Site Scripting (XSS) vulnerability (CWE-79). The issue is specifically located in the "nomTransportista" parameter at the "/es/carriers/update" endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code ...
CVE-2026-59659
The Repasat application contains a Cross-Site Scripting (XSS) vulnerability. The flaw is located in the "nomZonaGeo" parameter at the "/es/geozones/update/149979" endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code within the victim's browser. N...
CVE-2026-85714
Technical details for CVE-2026-85714 are not publicly available in the provided documents. Action: monitor for updates.
CVE-2026-94180
The Monetizemore Advanced Ads WordPress plugin (versions up to and including 2.0.26 ) is vulnerable to an Authorization Bypass Through User-Controlled Key (CWE-639). This flaw allows an attacker to retrieve embedded sensitive data from the application. While the vulnerability details confirm the ...
CVE-2026-94639
The Apache Thrift Java bindings are vulnerable to an uncaught exception and improper handling of exceptional conditions , specifically involving the allocation of resources without limits or throttling . This issue is identified as a residual of CVE-2026-61373, involving a thread-death black hole...
CVE-2026-94405
The Shahjada Download Manager WordPress plugin (versions up to 3.3.71 ) is vulnerable to an Authorization Bypass Through User-Controlled Key vulnerability. This flaw allows an attacker to retrieve embedded sensitive data from the system. The vulnerability is classified as a Sensitive Data Exposur...
CVE-2026-97652
The WP Statistics WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 14.16.14 . The root cause is insufficient input sanitization and output escaping of the REQUEST_URI Query-Parameter Key. This allows unauthenticated attackers to inject arb...
CVE-2026-87920
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.10.6 . The root cause is insufficient input sanitization and output escaping within the Comment Content via Output-Buffer Regex Rewrite . This flaw allows unauthenticat...
CVE-2026-85492
The All in One SEO plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 5.0.1.1 . The root cause is insufficient input sanitization and output escaping involving the URL Pathname . An unauthenticated attacker can inject arbitrary web scrip...
CVE-2026-94541
The WPMobile.App – Android and iOS App Builder plugin for WordPress (slug wpappninja) is vulnerable to an authorization bypass in all versions up to and including 11.82 . The flaw stems from a failure to verify user permissions when handling the wpapp_category[] parameter. If the plugin's mail-to...
CVE-2026-102731
The Apache Directory LDAP API (versions 1.2.0 before 1.2.9 ) is vulnerable to a memory allocation flaw caused by an excessive size value during BER decoding . A malicious peer or Man-in-the-Middle (MITM) actor can send a small BER-encoded response that triggers a large memory allocation before da...
CVE-2026-59673
The Repasat application is vulnerable to a Cross-Site Scripting (XSS) vulnerability. Specifically, the "nomTipoCli" parameter at the "/es/clientypes/update/109441" endpoint is affected. Successful exploitation could allow an attacker to trick a user into executing arbitrary code within the victim...
CVE-2026-59672
The Repasat application is subject to a Cross-Site Scripting (XSS) vulnerability. The root cause is linked to the "nomGrupoEmpresarial" parameter at the "/es/corporategroups/update/246" endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code within ...
CVE-2026-94635
A vulnerability exists in the Apache Thrift Lua bindings (versions before 0.25.0 ) caused by the improper handling of length parameter inconsistencies . Specifically, the TBinaryProtocol:readMessageBegin function may bypass checkStringSize on the pre-versioned name, allowing a remote attacker to ...
CVE-2026-80298
A SQL injection vulnerability exists in the HAVELSAN Inc. Sef - AI Chatbot Platform affecting versions before 2.1 . The flaw stems from the improper neutralization of special elements used in SQL commands, which could allow an attacker to execute unauthorized queries. The vendor has stated that t...
CVE-2026-59671
The Repasat application is affected by a Cross-Site Scripting (XSS) vulnerability. The specific affected endpoint is “/es/datatables/getemployeetypesdatatable” . Successful exploitation could allow an attacker to trick a user into executing arbitrary code within the victim’s browser. No specific ...
CVE-2026-95512
A flaw exists in the FreeType library, specifically within its CID font loader . A remote attacker could exploit this by tricking a user into opening content containing a specially crafted CID-keyed font . This font can trigger repeated allocations and decryptions of subroutine data across multip...
CVE-2026-95605
The WordPress WP Data Access plugin (versions
CVE-2026-80443
HAVELSAN Inc. Sef - AI Chatbot Platform (versions before 2.1 ) is vulnerable to an improper certificate validation flaw within the API Tool Runner component. This vulnerability allows an Adversary in the Middle (AiTM) to intercept communications. While the impact is rated as High with potential f...
CVE-2026-59670
The Repasat application is affected by a Cross-Site Scripting (XSS) vulnerability. The flaw exists within the "nomListaValidacion" parameter at the endpoint "/es/validationslists/assignList/Employee/45659" . Successful exploitation could allow an attacker to trick a user into executing arbitrary ...
CVE-2026-80337
The HAVELSAN Inc. Sef - AI Chatbot Platform (versions before 2.1 ) is susceptible to a Missing Authorization vulnerability (CWE-862 ). This flaw allows attackers to access functionality that is not properly constrained by Access Control Lists (ACLs) , specifically enabling unauthorized Cross-Chat...
CVE-2026-80464
A Server-Side request forgery (SSRF) vulnerability exists in the API Tool Runner of HAVELSAN Inc. Sef - AI Chatbot Platform . This issue allows an attacker to perform SSRF attacks. The vulnerability affects versions before 2.1 . Notably, the vendor has stated that this product is no longer suppor...
CVE-2026-95607
The WordPress WPLMS theme (versions
CVE-2026-59669
The Repasat application is vulnerable to a Cross-Site Scripting (XSS) flaw (CWE-79). The issue exists in the "name" parameter of the endpoint “/es/attachmenttypes/update/203336” . Successful exploitation could allow an attacker to trick a user into executing arbitrary code within their browser. N...
CVE-2026-91784
The cjbassi/gotop utility is vulnerable to local argument injection within its process termination functionality. The software fails to sanitize process names before passing them directly to the pkill command. A local attacker can exploit this by creating a process with a crafted name starting wi...
CVE-2026-96327
A SQL Injection vulnerability exists in the WordPress WPLMS plugin for versions prior to 1.9.9.8.2 . The flaw was identified by Rafie Muhammad. While the specific root cause and practical impact are not detailed in the provided documents, users are advised to update to version 1.9.9.8.2 or later ...
CVE-2026-95608
The WordPress HUSKY plugin (versions
CVE-2026-94670
The Everest Forms plugin for WordPress (versions
CVE-2026-95595
The WordPress Plugin Disable and Remove Google Fonts | GDPR & DSGVO friendly (versions
CVE-2026-95610
The UpSolution Core plugin for WordPress (versions
CVE-2026-18036
Bouncy Castle for Java versions prior to 1.86 are vulnerable to a timing side-channel attack in the NTRU implementation. The root cause is the use of the % operator in three helpers, leading to integer division where latency depends on the secret operand. Specifically, Polynomial.modQ divides by ...
CVE-2026-96461
A Broken Access Control vulnerability exists in the Amelia WordPress plugin, affecting versions
CVE-2026-96337
The WordPress ProfilePress plugin (versions