409231 matches found
CVE-2026-93746
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-103478
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-104803
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-101921
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-96574
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-96278
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-107845 Contao: Cross-site scripting in the comments bundle
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments in comments-bundle/contao/dca/tlcomments.php. When a backend user ope...
CVE-2026-107844 Contao: Path traversal in the images controller
Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled path parameter to the configured image target directory with Path::join but does not use Path::isBasePath to verify that the canonical path remains inside that directory. An...
CVE-2026-107843 Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check
Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORMSUBMIT or the preceding captcha result. resendActivationMail can then invok...
CVE-2026-107842 Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.indexprotected is changed from enabled to disabled. Authorization metadata is stored per row...
CVE-2026-94538
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-96840
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-107742
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-96682
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-100196
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-89100
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-103427
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-103482
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-93775
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-107712
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-104801
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-95684
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-104766
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-107841
The pacioli-guard document-layer consent gate in pacioli (versions 0.9.6 through 0.10.0 ) contains an incorrect authorization vulnerability (CWE-863). The flaw allows nested cancellation operations to inherit consent from an enclosing governed act without verifying if the specific marker authoriz...
CVE-2026-108096
The AWS Amplify API Category contains an improper authorization vulnerability in the query resolvers generated by the @aws-amplify/graphql-index-transformer component. This flaw exists in versions prior to 3.1.2 and allows an authenticated remote user to read records owned by other users within t...
CVE-2026-107840
The yopass secret-sharing service is vulnerable to a memory exhaustion attack in versions prior to 14.7.0 . The root cause lies in the Prometheus metrics middleware within pkg/server/server.go, which uses the attacker-controlled r.Method value as a label for yopass_http_requests_total and yopass_...
CVE-2026-14379
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-107839
The ageLANServer software, which provides a cross-platform web server and launcher for Age of Empires and Age of Mythology games, is vulnerable to a Remote Denial of Service (DoS) . In versions prior to 1.15.2 , the AoE3 POST /game/cloud/getFileURL handler lacks a request body size limit and fail...
CVE-2026-92975
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-104725
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-107838
The RIOT microcontroller operating system (versions 2023.07 through 2026.07 ) is vulnerable to a reachable assertion in the nanocoap_fileserver component. The root cause is that callers in sys/net/application_layer/nanocoap/fileserver.c ignore a failure returned by _resp_init() when coap_build_re...
CVE-2026-107837
The RIOT open-source microcontroller operating system (versions 2026.07 and earlier ) contains an out-of-bounds read vulnerability in the _receive() function located within sys/net/gnrc/network_layer/sixlowpan/gnrc_sixlowpan.c. The root cause is insufficient validation; the system routes undersiz...
CVE-2026-103912
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-15178
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-12054
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-6243
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-17025
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-96667
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-94421
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-107836
The RIOT microcontroller operating system (version 2026.07 and earlier ) contains a vulnerability in the nanoCoAP client function nanocoap_sock_get_slice() located in sys/net/application_layer/nanocoap/sock.c. The root cause is a failure to verify that server-controlled szx and derived offsets ma...
CVE-2026-14335
The Easy Digital Downloads WordPress plugin, versions
CVE-2026-77183
The FooSales (Point of Sale for WooCommerce) plugin for WordPress (versions
CVE-2026-104899
The GeoDirectory WordPress plugin (specifically the WP Business Directory and Classified Listings Directory components) is vulnerable to an Unauthenticated Local File Inclusion (LFI) vulnerability in versions
CVE-2026-103520
A Stored Cross-Site Scripting (XSS) vulnerability exists in the HivePress WordPress plugin (versions
CVE-2026-83526
The WordPress FV Player 8 plugin (versions
CVE-2026-107835
The OWASP Coraza WAF library (prior to version 3.8.1 ) contains a Cookie Parser Confusion vulnerability in the internal/cookies.ParseCookies function within internal/cookies/cookies.go. The root cause is that the library handles boundary ASCII control characters and control-only or empty cookie n...
CVE-2026-107824
The x64dbg-MCP Server plugin, a native Model Context Protocol (MCP) tool for x64dbg, is vulnerable to an authentication bypass in versions prior to 1.1 . The software exposes full debugger functionality over HTTP and SSE while listening on the default interface (0.0.0.0 ) without authentication. ...
CVE-2026-102402
This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...
CVE-2026-107820
The x64dbg-MCP Server (prior to version 1.2 ) is vulnerable to a pre-authentication denial of service due to an integer overflow in src/core/mcp_server.zig. The parseContentLength() function fails to bound the Content-Length value, which is subsequently used in an unchecked usize addition within ...