| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-99100 | 0.00 | — | 0.00 | Oct 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate firmware record lengths The p54 firmware parser accesses component ID and component version records without checking that their lengths cover the fields being read. A malformed record can… | |||
| CVE-2026-1928 | Hig | 0.50 | 8.8 | 0.01 | Oct 28, 2026 | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible… | ||
| CVE-2026-118276 | Low | 0.16 | 3.5 | 0.00 | Oct 28, 2026 | A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderers/web_core/src/v0_9/basic_catalog/expressions/expression_parser.ts of the component Parser. This manipulation causes resource consumption.… | ||
| CVE-2026-118275 | Med | 0.27 | 5.3 | 0.00 | Oct 28, 2026 | A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Resolver. The manipulation results in resource consumption. The attack can be… | ||
| CVE-2026-116613 | Hig | 0.49 | 7.5 | 0.00 | Oct 28, 2026 | The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.6 via the 'animated-text' shortcode. This is due to the atb_shortcode_handler() function fetching an arbitrary post by attacker-supplied ID and, in… | ||
| CVE-2026-111727 | Med | 0.35 | 6.4 | 0.00 | Oct 28, 2026 | The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vs_text_submitbtn' parameter in all versions up to, and including, 1.4.05 due to insufficient input sanitization and output escaping. This makes it possible for… | ||
| CVE-2026-111255 | Hig | 0.49 | 7.5 | 0.01 | Oct 28, 2026 | The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the upload_image function. This is due to insufficient file type validation in upload_image due… | ||
| CVE-2026-97019 | Hig | 0.47 | 7.2 | 0.00 | Oct 28, 2026 | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it possible for… | ||
| CVE-2026-84999 | Cri | 0.64 | 9.8 | 0.00 | Oct 28, 2026 | The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the piereg_file_upload function. This is due to the plugin performing file type validation via wp_check_filetype and… | ||
| CVE-2026-118384 | Med | 0.40 | 6.1 | 0.00 | Oct 28, 2026 | GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c. | ||
| CVE-2026-118378 | Hig | 0.44 | 7.8 | 0.00 | Oct 28, 2026 | Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted table_name to the describe_table tool. Attackers, including AI agents steered by untrusted content, can close the… | ||
| CVE-2026-118377 | Hig | 0.42 | 7.5 | 0.00 | Oct 28, 2026 | mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(),… | ||
| CVE-2026-118376 | Med | 0.27 | 5.3 | 0.00 | Oct 28, 2026 | WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via web_fetch or URL-based… | ||
| CVE-2026-118375 | Hig | 0.46 | 8.1 | 0.00 | Oct 28, 2026 | llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB… | ||
| CVE-2026-118374 | Med | 0.31 | 5.9 | 0.00 | Oct 28, 2026 | LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or… | ||
| CVE-2026-118373 | Low | 0.17 | 3.7 | 0.00 | Oct 28, 2026 | LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_alloc() only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports,… | ||
| CVE-2026-118372 | Low | 0.17 | 3.7 | 0.00 | Oct 28, 2026 | LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places… | ||
| CVE-2026-118371 | Low | 0.17 | 3.7 | 0.00 | Oct 28, 2026 | LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a… | ||
| CVE-2026-118370 | Med | 0.31 | 5.9 | 0.00 | Oct 28, 2026 | libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30… | ||
| CVE-2026-118274 | Med | 0.21 | 4.3 | 0.00 | Oct 28, 2026 | A vulnerability has been found in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unknown functionality of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the component Binder. The manipulation leads to resource consumption. The attack can be… | ||
| CVE-2026-118273 | Med | 0.21 | 4.3 | 0.00 | Oct 28, 2026 | A flaw has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the function DataModel.set of the file renderers/web_core/src/v0_9/state/data-model.ts. Executing a manipulation can lead to resource consumption. It is possible to launch the attack… | ||
| CVE-2026-117610 | Med | 0.31 | 5.9 | 0.00 | Oct 28, 2026 | libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external… | ||
| CVE-2026-117609 | Hig | 0.39 | 7.1 | 0.00 | Oct 28, 2026 | rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a… | ||
| CVE-2026-117608 | Med | 0.33 | 6.1 | 0.00 | Oct 28, 2026 | Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers to bypass frame table bounds checks using crafted header fields. Attackers can supply a malicious .md2 file whose numFrames and numVertices values wrap the… | ||
| CVE-2026-117607 | Hig | 0.47 | 7.2 | 0.01 | Oct 28, 2026 | Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc file, then request it… | ||
| CVE-2026-117606 | Med | 0.28 | 5.4 | 0.00 | Oct 28, 2026 | NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares used_by with the user. Attackers holding the default nexopos.use.registers… | ||
| CVE-2026-117605 | Med | 0.21 | 4.3 | 0.00 | Oct 28, 2026 | nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another… | ||
| CVE-2026-115624 | Med | 0.34 | 5.3 | 0.00 | Oct 28, 2026 | GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts. | ||
| CVE-2026-111314 | Hig | 0.47 | 7.2 | 0.00 | Oct 28, 2026 | The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atkp_product_producturl' parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output… | ||
| CVE-2026-109999 | Hig | 0.47 | 7.2 | 0.00 | Oct 28, 2026 | The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.2.8… | ||
| CVE-2026-109974 | Med | 0.35 | 6.4 | 0.00 | Oct 28, 2026 | The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'more_link' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization… | ||
| CVE-2026-109848 | Med | 0.27 | 4.2 | 0.00 | Oct 28, 2026 | GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the contents of pages without the required read… | ||
| CVE-2026-109209 | Med | 0.35 | 6.4 | 0.00 | Oct 28, 2026 | The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_fields[embedcode]' parameter in all versions up to, and including, 4.9.7 due to insufficient input… | ||
| CVE-2026-107745 | Med | 0.27 | 4.2 | 0.00 | Oct 28, 2026 | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.8.4 This makes it possible for… | ||
| CVE-2026-107625 | Med | 0.35 | 6.4 | 0.00 | Oct 28, 2026 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_url' parameter in all versions up to, and including, 2.14.0 due to insufficient… | ||
| CVE-2026-105272 | Med | 0.27 | 4.2 | 0.00 | Oct 28, 2026 | GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability, an authenticated attacker may obtain the contents and comments of pages without the required read… | ||
| CVE-2015-20129 | Hig | 0.57 | 8.8 | 0.00 | Oct 28, 2026 | CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to… | ||
| CVE-2014-125138 | Hig | 0.57 | 8.8 | 0.00 | Oct 28, 2026 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the page_image or cat_image parameters to the… | ||
| CVE-2014-125137 | Med | 0.42 | 6.5 | 0.01 | Oct 28, 2026 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to… | ||
| CVE-2014-125136 | Med | 0.38 | 5.9 | 0.00 | Oct 28, 2026 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes database backups in the web-accessible /admin/backup directory. Unauthenticated attackers can list the directory or guess… | ||
| CVE-2013-20009 | Med | 0.31 | 4.8 | 0.00 | Oct 28, 2026 | Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in setup.cgi. Attackers can save a malicious policy name from the AccessRes.htm page that executes in… | ||
| CVE-2013-20008 | Med | 0.44 | 6.8 | 0.00 | Oct 28, 2026 | Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the current password. Attackers with access to an authenticated administrator browser session can set a new password to lock out… | ||
| CVE-2013-20007 | Hig | 0.47 | 7.2 | 0.02 | Oct 28, 2026 | Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer_interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd… | ||
| CVE-2026-118272 | Med | 0.21 | 4.3 | 0.00 | Oct 28, 2026 | A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Error Handler. Performing a manipulation results in information… | ||
| CVE-2026-118271 | Med | 0.21 | 4.3 | 0.00 | Oct 28, 2026 | A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component data-context Resolver. Such manipulation leads to resource consumption. The attack… | ||
| CVE-2026-106013 | Cri | 0.57 | 9.8 | 0.01 | Oct 28, 2026 | The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verify_twitter_callback function because after exchanging the visitor's… | ||
| CVE-2026-110879 | Cri | 0.57 | 9.8 | 0.01 | Oct 28, 2026 | jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added… | ||
| CVE-2026-110747 | Hig | 0.42 | 7.5 | 0.00 | Oct 28, 2026 | ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks (_inputPtr + len) <= _inputEnd using signed arithmetic. For values near Integer.MAX_VALUE the addition overflows to a negative value and… | ||
| CVE-2026-118129 | Med | 0.34 | 6.3 | 0.00 | Oct 28, 2026 | A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument… | ||
| CVE-2026-104895 | Hig | 0.42 | 7.5 | 0.00 | Oct 28, 2026 | The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i… |
- CVE-2026-99100Oct 28, 2026risk 0.00cvss —epss 0.00
In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate firmware record lengths The p54 firmware parser accesses component ID and component version records without checking that their lengths cover the fields being read. A malformed record can…
- risk 0.50cvss 8.8epss 0.01
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible…
- risk 0.16cvss 3.5epss 0.00
A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderers/web_core/src/v0_9/basic_catalog/expressions/expression_parser.ts of the component Parser. This manipulation causes resource consumption.…
- risk 0.27cvss 5.3epss 0.00
A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Resolver. The manipulation results in resource consumption. The attack can be…
- risk 0.49cvss 7.5epss 0.00
The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.6 via the 'animated-text' shortcode. This is due to the atb_shortcode_handler() function fetching an arbitrary post by attacker-supplied ID and, in…
- risk 0.35cvss 6.4epss 0.00
The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vs_text_submitbtn' parameter in all versions up to, and including, 1.4.05 due to insufficient input sanitization and output escaping. This makes it possible for…
- risk 0.49cvss 7.5epss 0.01
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the upload_image function. This is due to insufficient file type validation in upload_image due…
- risk 0.47cvss 7.2epss 0.00
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it possible for…
- risk 0.64cvss 9.8epss 0.00
The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the piereg_file_upload function. This is due to the plugin performing file type validation via wp_check_filetype and…
- risk 0.40cvss 6.1epss 0.00
GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c.
- risk 0.44cvss 7.8epss 0.00
Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted table_name to the describe_table tool. Attackers, including AI agents steered by untrusted content, can close the…
- risk 0.42cvss 7.5epss 0.00
mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(),…
- risk 0.27cvss 5.3epss 0.00
WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via web_fetch or URL-based…
- risk 0.46cvss 8.1epss 0.00
llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB…
- risk 0.31cvss 5.9epss 0.00
LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or…
- risk 0.17cvss 3.7epss 0.00
LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_alloc() only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports,…
- risk 0.17cvss 3.7epss 0.00
LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places…
- risk 0.17cvss 3.7epss 0.00
LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a…
- risk 0.31cvss 5.9epss 0.00
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30…
- risk 0.21cvss 4.3epss 0.00
A vulnerability has been found in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unknown functionality of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the component Binder. The manipulation leads to resource consumption. The attack can be…
- risk 0.21cvss 4.3epss 0.00
A flaw has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the function DataModel.set of the file renderers/web_core/src/v0_9/state/data-model.ts. Executing a manipulation can lead to resource consumption. It is possible to launch the attack…
- risk 0.31cvss 5.9epss 0.00
libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external…
- risk 0.39cvss 7.1epss 0.00
rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a…
- risk 0.33cvss 6.1epss 0.00
Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers to bypass frame table bounds checks using crafted header fields. Attackers can supply a malicious .md2 file whose numFrames and numVertices values wrap the…
- risk 0.47cvss 7.2epss 0.01
Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc file, then request it…
- risk 0.28cvss 5.4epss 0.00
NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares used_by with the user. Attackers holding the default nexopos.use.registers…
- risk 0.21cvss 4.3epss 0.00
nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another…
- risk 0.34cvss 5.3epss 0.00
GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts.
- risk 0.47cvss 7.2epss 0.00
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atkp_product_producturl' parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output…
- risk 0.47cvss 7.2epss 0.00
The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.2.8…
- risk 0.35cvss 6.4epss 0.00
The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'more_link' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization…
- risk 0.27cvss 4.2epss 0.00
GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the contents of pages without the required read…
- risk 0.35cvss 6.4epss 0.00
The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_fields[embedcode]' parameter in all versions up to, and including, 4.9.7 due to insufficient input…
- risk 0.27cvss 4.2epss 0.00
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.8.4 This makes it possible for…
- risk 0.35cvss 6.4epss 0.00
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_url' parameter in all versions up to, and including, 2.14.0 due to insufficient…
- risk 0.27cvss 4.2epss 0.00
GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability, an authenticated attacker may obtain the contents and comments of pages without the required read…
- risk 0.57cvss 8.8epss 0.00
CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to…
- risk 0.57cvss 8.8epss 0.00
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the page_image or cat_image parameters to the…
- risk 0.42cvss 6.5epss 0.01
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to…
- risk 0.38cvss 5.9epss 0.00
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes database backups in the web-accessible /admin/backup directory. Unauthenticated attackers can list the directory or guess…
- risk 0.31cvss 4.8epss 0.00
Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in setup.cgi. Attackers can save a malicious policy name from the AccessRes.htm page that executes in…
- risk 0.44cvss 6.8epss 0.00
Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the current password. Attackers with access to an authenticated administrator browser session can set a new password to lock out…
- risk 0.47cvss 7.2epss 0.02
Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer_interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd…
- risk 0.21cvss 4.3epss 0.00
A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Error Handler. Performing a manipulation results in information…
- risk 0.21cvss 4.3epss 0.00
A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component data-context Resolver. Such manipulation leads to resource consumption. The attack…
- risk 0.57cvss 9.8epss 0.01
The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verify_twitter_callback function because after exchanging the visitor's…
- risk 0.57cvss 9.8epss 0.01
jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added…
- risk 0.42cvss 7.5epss 0.00
ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks (_inputPtr + len) <= _inputEnd using signed arithmetic. For values near Integer.MAX_VALUE the addition overflows to a negative value and…
- risk 0.34cvss 6.3epss 0.00
A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument…
- risk 0.42cvss 7.5epss 0.00
The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i…