Tagged “cve.org”
CVEs tagged cve.org, newest first.
50242 CVEsRSS
CVE-2026-101306Critical· 9.8SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred
SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred. A process could clear the restriction by sending the descriptor to itself over a Unix domain socket. A process in a jail that has…
CVE-2026-101305High· 8.8renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments
renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on…
CVE-2026-101304High· 7.1When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a di…
When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a di…
CVE-2026-101303High· 7.5The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. A process in a classic (non-VNET) jail can send UDP datagrams to services liste…
The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. A process in a classic (non-VNET) jail can send UDP datagrams to services liste…
CVE-2026-101302Medium· 6.5TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding
TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invali…
CVE-2025-68404High· 7.5A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter
A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vul…
CVE-2025-68403Medium· 4.6An external control of system or configuration setting vulnerability has been reported to affect QuRouter
An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have…
CVE-2025-66275High· 7.7A path traversal vulnerability has been reported to affect Video Station
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed …
CVE-2025-66272High· 7.7A path traversal vulnerability has been reported to affect Video Station
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed …
CVE-2025-29897Low· 2.3A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central
A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have alread…
CVE-2025-29896Low· 2.3A NULL pointer dereference vulnerability has been reported to affect Qsync Central
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the…
CVE-2025-29895Low· 2.3A NULL pointer dereference vulnerability has been reported to affect Qsync Central
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the…
CVE-2026-103304Medium· 5.3The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger bookin…
The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger bookin…
CVE-2026-109145Critical· 9.8The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, al…
The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, al…
CVE-2026-104643Medium· 4.2The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private…
The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private…
CVE-2026-96537High· 7.5The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missi…
The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missi…
CVE-2026-58099High· 7.0When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock
When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another threa…
CVE-2026-74920High· 7.1The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scrip…
The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scrip…
CVE-2026-106031Medium· 6.5The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored c…
The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored c…
CVE-2026-58100High· 7.0kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check
kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent …
CVE-2026-58098High· 8.4When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps
When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the c…
CVE-2026-108587Critical· 9.8The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missin…
CVE-2026-3712High· 7.3The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controll…
The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controll…
CVE-2026-14572Medium· 6.4The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content in all versions up to, and including, 6.2.0 due to insufficient input sanitiz…
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content in all versions up to, and including, 6.2.0 due to insufficient input sanitiz…
CVE-2026-76665High· 7.1A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow.
A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow.
CVE-2026-76667Medium· 5.7A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.
A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.
CVE-2026-76666Medium· 4.7A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.
A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.
CVE-2026-110925Medium· 5.4A flaw was found in OpenSSH
A flaw was found in OpenSSH. A username entered on the ssh command line can still contain '$' or a non-trailing backslash. When a configuration expands %u inside ProxyCommand or Match exec, those characters are passed into the shell.
CVE-2026-110923Medium· 6.5A flaw was found in OpenSSH
A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected.
CVE-2026-78001Medium· 6.4The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to insu…
The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to insu…