An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message authentication code, allowing arbitrary message input, potential…
|
Race Condition
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
CVE-2026-44018
— Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.91.0, the METS-GBS backend's XML parsing and the inp…
|
XML External Entity
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
CVE-2025-11919
— Unprotected temporary directories in Wolfram Cloud may result in privilege escalation
The default JVM can access files and directories under `/tmp/` including the `$TemporaryDirectory` of other users on the same cloud instance (`/tmp/UserTemporaryFiles/`). The `-init` file for the th…
|
Misconfiguration
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
CVE-2026-9639
— Authenticated Denial of Service via Malicious Backup Tarball in LXD
Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of servic…
lxd
|
Remote
|
Memory Corruption
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device P…
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
CVE-2026-45195
— GPU DDK - rgxfw_set_mips_fault_address(&psInit->sFaultPhysAddr) is untrusted
Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory read or write outside the permitted range of memory for the host kernel.
A…
|
Memory Corruption
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
CVE-2026-5757
— There exists an unauthenticated remote information disclosure vulnerability in Ollama's m…
Unauthenticated remote information disclosure vulnerability in Ollama's model quantization engine allows an attacker to read and exfiltrate the server's heap memory, potentially leading to sensitive …
|
Information Disclosure
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
CVE-2026-21734
— GPU DDK - libusc OOB write at TreeRemove during WebGPU shader compilation
A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader compiler library. On certain platforms, wh…
|
Memory Corruption
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
CVE-2026-57667
— WordPress Groundhogg plugin <= 4.5 - SQL Injection vulnerability
Sales Representative SQL Injection in Groundhogg <= 4.5 versions.
Remote
|
Injection
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
CVE-2026-57665
— WordPress GravityView plugin <= 3.0.0 - Insecure Direct Object References (IDOR) vulnerab…
Unauthenticated Insecure Direct Object References (IDOR) in GravityView <= 3.0.0 versions.
Remote
|
Authorization
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
CVE-2026-57664
— WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.1.6 - Sensitive Data Expo…
Unauthenticated Sensitive Data Exposure in Bopo – WooCommerce Product Bundle Builder <= 1.1.6 versions.
Remote
|
Information Disclosure
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
CVE-2026-57663
— WordPress Recipe Maker For Your Food Blog from Zip Recipes plugin <= 8.2.7 - SQL Injectio…
Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes <= 8.2.7 versions.
Remote
|
Injection
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
CVE-2026-57662
— WordPress Contest Gallery plugin <= 30.0.0 - SQL Injection vulnerability
Contributor SQL Injection in Contest Gallery <= 30.0.0 versions.
Remote
|
Injection
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
CVE-2026-57661
— WordPress WPComplete plugin <= 2.9.5.5 - Broken Access Control vulnerability
Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions.
Remote
|
Authorization
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
CVE-2026-57660
— WordPress Booking and Rental Manager plugin <= 2.7.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions.
Remote
|
Authorization
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
CVE-2026-57659
— WordPress Paid Memberships Pro - Add Member From Admin plugin <= 0.7.2 - Cross Site Reque…
Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin <= 0.7.2 versions.
Remote
|
Cross-Site Request Forgery
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
CVE-2026-57658
— WordPress TemplateSpare plugin <= 4.2.0 - Arbitrary File Upload vulnerability
Administrator Arbitrary File Upload in TemplateSpare <= 4.2.0 versions.
Remote
|
Misconfiguration
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
CVE-2026-57657
— WordPress Gmail SMTP plugin <= 1.2.3.19 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in Gmail SMTP <= 1.2.3.19 versions.
Remote
|
Cross-Site Request Forgery
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
CVE-2026-57656
— WordPress Hester Core plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability
Author Cross Site Scripting (XSS) in Hester Core <= 1.1.8 versions.
Remote
|
Cross-Site Scripting
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
CVE-2026-57655
— WordPress Child theme Wizard plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerabil…
Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard <= 1.4 versions.
Remote
|
Cross-Site Request Forgery
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
Jun 26, 2026
