Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- UnknownThe Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coup…Oct 15, 2026
- UnknownThe Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as…Oct 15, 2026
- Medium5.3The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the…Oct 15, 2026
- UnknownThe eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthen…Oct 15, 2026
- UnknownWhen an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer.Oct 15, 2026
- UnknownWhen the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter.Oct 15, 2026
- UnknownSCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a descriptor was transferred.Oct 15, 2026
- Unknownrenameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments.Oct 15, 2026
- UnknownWhen fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capabili…Oct 15, 2026
- UnknownThe IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address.Oct 15, 2026
- UnknownTLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding.Oct 15, 2026
- Medium4.8A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter.Oct 15, 2026
- Medium4.6An external control of system or configuration setting vulnerability has been reported to affect QuRouter.Oct 15, 2026
- High7.7A path traversal vulnerability has been reported to affect Video Station.Oct 15, 2026
- High7.7A path traversal vulnerability has been reported to affect Video Station.Oct 15, 2026
- Low2.3A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central.Oct 15, 2026
- Low2.3A NULL pointer dereference vulnerability has been reported to affect Qsync Central.Oct 15, 2026
- Low2.3A NULL pointer dereference vulnerability has been reported to affect Qsync Central.Oct 15, 2026
- UnknownThe xHCI (USB 3) device model did not validate or save the event ring size provided by the guest.Oct 15, 2026
- High7.1A security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruption of address and potentially redirect execution flow.Oct 15, 2026
- High8.8The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5.Oct 15, 2026
- Medium5.3Rede Itaú for WooCommerce 3.7.1 - 5.5.2 - Unauthenticated Order Status Manipulation via maxiPago Debit WebhookOct 15, 2026
- Medium5.3Rede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order Status Manipulation via 3DS Failure WebhookOct 15, 2026
- UnknownTutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content OverwriteOct 15, 2026
- Medium6.4VK Blocks <= 1.126.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' FeatureOct 15, 2026