Security Check

security.bloxprod.io

Schwachstellen, die jetzt zählen.

CVE für Linux-Server, Android, Apple-Telefone, Windows, Browser, Krypto-Wallets und übrige Software. Ein Klick auf den Titel öffnet das Original beim Herausgeber.

6600Artikel
1293Kritisch
3007Hoch
1779Aktiv ausgenutzt
Alle StufenKritischHochMittelNiedrigAktiv ausgenutzt
Kritisch 9.1Software

SOGo before 5.12.13 contains a missing rate limiting vulnerability in its web login TOTP verification that allows attackers who already possess a victim's…

CVE-2026-12713112. Nov 2026

SOGo before 5.12.13 contains a missing rate limiting vulnerability in its web login TOTP verification that allows attackers who already possess a victim's password to brute-force the second-factor code without triggering any lockout. Attackers can send repeated POST requests to /SOGo/connect with wrong verification codes at high speed since failed TOTP attempts never increment the failed-login counter and SOGoMaximumFailedLoginCount does not apply, enabling indefinite…

Original bei NVDAlle Quellen (1)
Kritisch 9.1Software

SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account…

CVE-2026-12711112. Nov 2026

SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account passwords by repeatedly guessing secret-question answers via the passwordRecoveryCheck endpoint without lockout or rate limiting. Attackers can submit unlimited candidate answers to obtain a valid recovery JWT, then use it to change the account password without the old credential and log in via the connect endpoint…

Original bei NVDAlle Quellen (1)
Hoch 7.1Software

Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet…

CVE-2026-12401812. Nov 2026

Gutenverse Form plugin for WordPress before 3.2.2 contains a CSV formula injection vulnerability that allows unauthenticated attackers to inject spreadsheet formula-trigger characters by submitting free-text field values to the public form-submit REST route, which sanitizes input with sanitize_text_field() without stripping characters such as =, +, @, or a leading minus. Attackers can store malicious formulas in entry-data post meta that are later exported unneutralized via…

Original bei NVDAlle Quellen (1)
Hoch 8.7Software

PapaParse before 5.7.1 contains an inefficient algorithmic complexity vulnerability that allows remote unauthenticated attackers to cause denial of service by…

CVE-2026-12705612. Nov 2026

PapaParse before 5.7.1 contains an inefficient algorithmic complexity vulnerability that allows remote unauthenticated attackers to cause denial of service by submitting delimiter-free quoted CSV input to Papa.parse(). Attackers can supply a single-column quoted CSV with no delimiters, triggering repeated full-buffer indexOf scans per row that grow quadratically with input size, exhausting CPU and blocking the Node.js event loop or freezing a browser tab.

Original bei NVDAlle Quellen (1)