200454 matches found
CVE-2026-57554 Use After Free in DSP Service
Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations...
CVE-2026-57546 Buffer Over-read in WLAN HAL
Transient DOS when processing a continuous receive command with a zero-sized global configuration override...
CVE-2026-57545 Untrusted Pointer Dereference in Graphics
Memory corruption when processing draw objects of incorrect type during graphics command list execution...
CVE-2026-57537 Use After Free in DSP Service
Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization...
CVE-2026-25302 Improper Verification of Cryptographic Signature in Boot
Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed...
CVE-2026-25291 Use After Free in Graphics
Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms...
CVE-2026-25274 Use After Free in Windows WLAN Host
Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization...
CVE-2026-25273 Out-of-bounds Write in Camera Driver
Memory Corruption when processing camera operations due to out-of-bounds write during driver updates...
CVE-2026-25272 Out-of-bounds Write in Camera Driver
Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation...
CVE-2026-25270 Out-of-bounds Write in Camera Driver
Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver...
CVE-2026-25269 Out-of-bounds Write in Camera Driver
Memory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated memory size...
CVE-2026-25267 Missing Authorization in Core
Memory corruption when non-secure loader rewrites page tables before secure memory initialization...
CVE-2026-25263 Out of Bounds write in Linux Camera
Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters...
CVE-2026-89289 Fast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint
The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id...
CVE-2026-86786 Slider Pro <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via sliderpro_multiple_images
The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as wel...
CVE-2026-94278 File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat
The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored si...
CVE-2026-94270 Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass and Order Manipulation via Webhook
The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verification disabled by default, allowing unauthenticated attackers to mark an unpaid order as paid, or to cancel or refund an existing order...
CVE-2026-94299 elegro Crypto Payment <= 1.0.1 - Unauthenticated Arbitrary Order Status Change via IPN Callback
The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where...
CVE-2026-94271 Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success Return
The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being...
CVE-2026-105776 bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL admin_transaction.php sql injection
A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4. Affected by this vulnerability is an unknown functionality of the file /admintransaction.php. This manipulation of the argument Username causes sql...
CVE-2026-105775 vllm-project vLLM Completions Request mamba_mixer2.py conv_ssm_forward out-of-bounds
A security vulnerability has been detected in vllm-project vLLM up to 0.31.0. This impacts the function convssmforward of the file vllm/modelexecutor/layers/mamba/mambamixer2.py of the component Completions Request Handler. The manipulation leads to out-of-bounds read. The attack is possible to b...
CVE-2026-75962 Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)
The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'useremail' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and...
CVE-2026-105708 imgproxy SVG svg.go sanitizeElement cross site scripting
A flaw has been found in imgproxy up to 4.0.17. Affected by this vulnerability is the function sanitizeElement of the file processing/svg/svg.go of the component SVG Handler. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has...
CVE-2026-97300 WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP Event Solution = 4.1.25 versions...
CVE-2026-41563 WordPress Sitemovr plugin <= 1.0.1 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Sitemovr = 1.0.1 versions...
CVE-2026-41558 WordPress WP Migration Plugin DB & Files – WP Synchro plugin <= 1.16.1 - 2FA Bypass vulnerability
Subscriber Bypass Vulnerability in WP Migration Plugin DB & Files – WP Synchro = 1.16.1 versions...
CVE-2026-39760 WordPress Real 3D FlipBook plugin <= 5.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Real 3D FlipBook = 5.5 versions...
CVE-2026-39789 WordPress Fluent Affiliate Pro plugin <= 1.6.4 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Fluent Affiliate Pro = 1.6.4 versions...
CVE-2026-39723 WordPress Morning for WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Green Invoice Morning for WooCommerce wc-gateway-greeninvoice allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Morning for WooCommerce: from n/a through 2.4.1...
CVE-2026-39599 WordPress WDS MCP Content Manager plugin <= 3.10.4 - Broken Access Control vulnerability
Contributor Broken Access Control in WDS MCP Content Manager = 3.10.4 versions...
CVE-2026-32582 WordPress IATO MCP plugin <= 1.12.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in iatoai IATO MCP iato-mcp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IATO MCP: from n/a through 1.12.0...
CVE-2026-32576 WordPress Faktur Pro for WooCommerce plugin <= 3.2.2 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in ZWEISCHNEIDER Faktur Pro for WooCommerce woorechnung allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Faktur Pro for WooCommerce: from n/a through 3.2.2...
CVE-2026-105072 WordPress FluentBooking Pro plugin < 2.5.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in FluentBooking Pro 2.5.0 versions...
CVE-2026-105706 SourceCodester Drug Recommendation System cross-site request forgery
A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected is an unknown function. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attac...
CVE-2026-105705 SourceCodester Drug Recommendation System add_drug.php cross site scripting
A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file Admin/adddrug.php. Performing a manipulation results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been released to the...
CVE-2026-105704 SourceCodester Drug Recommendation System Auth Guard improper authentication
A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the component Auth Guard. Such manipulation of the argument userid leads to improper authentication. The attack can be executed remotely. The exploit is publicly available and migh...
CVE-2026-105621 jishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorization
A security flaw has been discovered in jishenghua jshERP up to 3.5. Affected is the function updateAccountHeadAndDetail of the file jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java of the component Financial Receipt Update Handler. Performing a manipulation results in imprope...
CVE-2026-105611 chillzhuang SpringBlade User Detail Endpoint RoleController.java improper authorization
A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/RoleController.java of the component User Detail Endpoint. This manipulation of the argument ID causes...
CVE-2026-105610 chillzhuang SpringBlade Parameter Submit Management ParamController.java improper authorization
A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/ParamController.java of the component Parameter Submit Management. The manipulation of the argument...
CVE-2026-105572 PickMall Lilishop Buyer Invoice List receipt authorization
A vulnerability has been found in PickMall Lilishop up to 4.2.4. This affects an unknown function of the file /buyer/trade/receipt of the component Buyer Invoice List. Such manipulation of the argument memberId leads to authorization bypass. It is possible to launch the attack remotely. The explo...
CVE-2026-105571 PickMall Lilishop Mobile Binding bindMobile improper authorization
A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function of the file /buyer/passport/member/bindMobile of the component Mobile Binding. This manipulation of the argument Username causes improper authorization. It is possible to initiate the attack...
CVE-2026-105487 yogeshojha reNgine listTargets Endpoint tasks.py subdomain_discovery os command injection
A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomaindiscovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched...
CVE-2026-104380 Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one
Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in psserveone. On HTTP/2 and HTTP/3 a WebSocket handshake arrives as an Extended CONNECT, which is matched as a GET and so reaches every GET route, API operation and mount. The...
CVE-2026-104044 Sssd: sssd: denial of service via crafted passkey kerberos authentication request
A flaw was found in sssd. A local attacker can trigger a Denial of Service DoS by sending a specially crafted Pluggable Authentication Module PAM request when passkey authentication is enabled. Due to a missing state validation check in passkey Kerberos handling, the PAM responder dereferences an...
CVE-2026-104043 Sssd: sssd: denial of service via undersized packet parsing in nss responder
A flaw was found in SSSD. A local attacker with access to the Name Service Switch NSS responder UNIX socket can trigger an integer underflow by sending a specially crafted request with an undersized packet header. This issue causes an out-of-bounds memory read during packet parsing, crashing the...
CVE-2026-104042 Sssd: sssd: denial of service via out-of-bounds read in pam responder
A flaw was found in sssd. A local attacker can cause a Denial of Service DoS by sending a crafted Pluggable Authentication Module PAM request containing a zero-length authentication token to the responder socket. Due to missing input validation, the service attempts to read beyond buffer boundari...
CVE-2026-104041 Sssd: sssd: denial of service via unbounded negative cache growth
A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for nonexistent entries through the Name Service Switch NSS responder. Because the negative cache does not limit the total number of stored entries and only removes expired records when an existing key is rechecke...
CVE-2026-104040 Sssd: sssd: information disclosure via odata injection in entra id lookups
A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol OData queries. A low-privileged local user can exploit this flaw by submitting a crafted...
CVE-2026-104039 Sssd: sssd: denial of service via stale connection state reuse in pam gssapi responder
A flaw was found in SSSD. A local user can cause a denial of service DoS by disrupting system authentication services. When handling Generic Security Services Application Programming Interface GSSAPI authentication in the Pluggable Authentication Module PAM responder, cached connection state is...
CVE-2026-105484 TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection
A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652B20230116. The impacted element is the function firmwarecheck of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument filename leads to os command injection. The attack...