383529 matches found
CVE-2026-49820 Probo has an open redirect bypass via path normalization
Probo is a self-hostable governance, risk, and compliance GRC platform built for engineering and security teams. Probo's saferedirect package validates redirect URLs used across authentication flows OIDC, SAML, session transfer, OAuth connectors, and trust-center magic links. Prior to version...
CVE-2026-53798 rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping
rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an...
CVE-2026-53786 rsync < 3.5.0 Filter Rule Bypass via --filter Merge Directive
rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules...
CVE-2026-53785 rsync < 3.5.0 Path Traversal Write Escape via --relative Mode
rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The makepath function follows symlinks pointing outside the destination...
CVE-2026-53784 rsync < 3.5.0 Path Traversal via Symlink Module Root
rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir to the module root at session initialization withou...
CVE-2026-53783 rsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsync
rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer...
CVE-2026-53803 rsync < 3.5.0 Symlink Following Arbitrary File Overwrite
rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject...
CVE-2026-53802 rsync < 3.5.0 Arbitrary File Read via Symlink Following
rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a...
CVE-2026-73509 OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batchrename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPathreq.SrcDir and validates renameObject.NewName with checkRelativePath, but does not...
CVE-2026-73508 Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord, and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName failed to...
CVE-2026-65936 RS9116W/SiWx917 malformed packet with increased length field causes memory leak
A malformed Bluetooth connection request message can cause the RS9116W/SiWx917 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below...
CVE-2026-28154 WordPress Samex and M.Anh WordPress themes affected by Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop...
CVE-2026-73507 Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode failed to preserve closing-tag parser state across invocations, so an unauthenticated remote attacker could trickle-feed repeated /...
CVE-2026-65935 Bypassing passkey entry in legacy pairing
Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the temporary key value. See vulnerability B-E3 in the related paper below...
CVE-2026-73506 Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, writes rune in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and...
CVE-2026-65934 BT122 plaintext pause encryption request causes DOS
An unencrypted 'pause encryption request' message causes a denial of service in the BT122 module. See vulnerability B-E10 in the related paper below...
CVE-2026-65933 BT122 malformed packet with increased length field causes memory leak
A malformed Bluetooth connection request message can cause the BT122 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below...
CVE-2026-73505 Oh My Posh: Arbitrary command execution via template injection in the path segment
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name...
CVE-2026-65932 BT122 stops advertising
The BT122 module stops advertising after receiving a plaintext 'pause enceryption response' message resulting in a denial of service. See vulnerability B-E2 in the related paper below...
CVE-2026-19293 SMP security request
SMP security request from peripheral does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below...
CVE-2026-19292 Bluetooth re-pairing with legitimate device can use lower security level
Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below...
CVE-2026-19291 Bluetooth re-pairing can use a lower security level than previous
Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x impacted. See V3 in the BLERP paper linked below...
CVE-2026-16101 forced re-pairing with already bonded device
Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below...
CVE-2026-19734 IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking
Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data price, cost, stock, SKU, and barcode of another company's product and t...
CVE-2026-68454 KVM: s390: pci: Fix handling of AIF enable without AISB
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix handling of AIF enable without AISB When a guest seeks to register IRQs without a summary bit specified, ensure that the associated GAITE then stores 0 for the guest AISB location instead of...
CVE-2026-68453 s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix buffer over-read in ccacipher2protkey Add validation of both the actual key buffer size and token length fields in all the ccachecksectoken functions. Additionally check in ccagencipherkey for possible underflow...
CVE-2026-68452 s390/zcrypt: Validate length for CCA AES cipher key requests
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA AES cipher key requests ccacipher2protkey derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if the token length...
CVE-2026-68451 s390/zcrypt: Validate length for CCA ECC private key requests
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA ECC private key requests ccaecc2protkey derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if the token length excee...
CVE-2026-14456 Unbounded Memory Growth in QUIC Server Incoming Channel Queue
Issue summary: When an OpenSSL QUIC server Listener SSL object processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the serve...
CVE-2026-66256 Apache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API)
UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired...
CVE-2026-28002 WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22...
CVE-2026-73401 WordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in InstaWP Connect = 0.1.3.7 versions...
CVE-2026-73403 WordPress User Registration plugin <= 5.2.6 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in User Registration = 5.2.6 versions...
CVE-2026-73357 WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability
Donor Cross Site Scripting XSS in GiveWP 4.16.6 versions...
CVE-2026-73349 WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in GiveWP 4.16.6 versions...
CVE-2026-73353 WordPress Revolut Gateway for WooCommerce plugin < 4.22.10 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce 4.22.10 versions...
CVE-2026-73346 WordPress MailChimp For WooCommerce plugin < 6.2 - SQL Injection vulnerability
Administrator SQL Injection in MailChimp For WooCommerce 6.2 versions...
CVE-2026-73340 WordPress Featured Image from URL plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...
CVE-2026-73344 WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability
Author Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...
CVE-2026-66704 WordPress Gutenverse Companion plugin <= 2.5.1 - Server Side Request Forgery (SSRF) vulnerability
Unauthenticated Server Side Request Forgery SSRF in Gutenverse Companion = 2.5.1 versions...
CVE-2026-66700 WordPress Smart Online Order for Clover plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Smart Online Order for Clover = 1.6.1 versions...
CVE-2026-66698 WordPress SureDash plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in SureDash = 1.10.1 versions...
CVE-2026-66697 WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...
CVE-2026-66693 WordPress Motors plugin <= 1.4.113 - Broken Access Control vulnerability
Subscriber Broken Access Control in Motors = 1.4.113 versions...
CVE-2026-66691 WordPress Nokri theme <= 1.6.6 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Nokri = 1.6.6 versions...
CVE-2026-66689 WordPress Anti Spam and list cleaner – AcyChecker plugin <= 2.0.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Anti Spam and list cleaner AcyChecker = 2.0.0 versions...
CVE-2026-66687 WordPress WpBookingly plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability
Customer Cross Site Scripting XSS in WpBookingly = 1.3.2 versions...
CVE-2026-66660 WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on = 2.5.1 versions...