CVEs

Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions.

Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions.

Subscriber SQL Injection in Cornerstone < 7.8.8 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions.

RadiX AX6600 WiFi 6 Tri-Band Gaming Router contains an OS command injection vulnerability, which may lead to arbitrary command execution with the root privilege by a user who logs in to the web console as an administrator.

Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions.

Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms <= 1.4.5 versions.

Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget <= 4.2.3 versions.

Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions.

A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is…

Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions.

Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions.

Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions.

Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions.

Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions.

Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.

Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions.

Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows Blind SQL Injection.This issue affects JetEngine: from n/a through 3.8.9.1.

Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions.

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpWax Directorist Booking allows Blind SQL Injection. This issue affects Directorist Booking: from n/a through 3.0.3.

Unauthenticated Broken Access Control in WooCommerce Anti-Fraud <= 7.2.6 versions.

Unauthenticated Broken Authentication in WooCommerce Dropshipping <= 5.2.4 versions.

Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions.

Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions.

Subscriber SQL Injection in Geo Mashup <= 1.13.19 versions.

Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthenticated file deletion. The deleteFileMessage Meteor method permanently deletes any uploaded file by ID without requiring authentication. When called via an…

Unauthenticated SQL Injection in JetSmartFilters <= 3.8.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Enfold <= 7.1.4 versions.

Backpropagate is a Python library for fine-tuning large language models on a single GPU. In versions 1.1.0 and 1.1.1, the optional Reflex web UI exposes a training control plane without authentication: dataset upload, model load, training start/stop, multi-run orchestration,…

Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting (XSS) vulnerability exploitable through content-type spoofing. The Remark42 image proxy fetches an…

Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated endpoint that accepted a signed token and applied subscription-enforcement side effects to the organization referenced in that token's claims, without verifying the token's…

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.56.0 through 1.101.0, 2.0.0b1, and 2.0.0b2, the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form that the previous…

Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, the Skool integration callback signed an attacker-controlled JSON blob into a session-shape JWT using the application's JWT_SECRET, and the auth middleware trusted every claim in that JWT without…

ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high…

Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source Traccar platform. In versions 9.7.19 and below, a single crafted deep link can silently hijack all GPS tracking parameters and redirect telemetry to an…

Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in Livechat files. Protected file downloads at /file-upload/:fileId/:name authorize livechat access using rc_room_type=l with rc_rid+rc_token, but the…

Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior, a high-severity Zip Slip vulnerability was identified in Streambert's subtitle extraction logic. The application does not sanitize archive entry filenames…

Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the…

Runtipi is a personal homeserver orchestrator. In versions 4.9.1 through 4.9.3, Runtipi serves marketplace app logos from files inside cloned app-store repositories through an unauthenticated endpoint, which leads to arbitrary file read through app-store logo symlinks. The path…

Subscriber Broken Access Control in WPBakery Page Builder <= 8.7.2 versions.

CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_type_denylist check fails to escape regex metacharacters in string entries, causing the denylist to silently not match the content types it is intended to block.…

Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions.

Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions.

Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access. This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which…

Unauthenticated Cross Site Scripting (XSS) in Kapee < 1.7.1 versions.

Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes this issue.

Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions.