CVE-2024-46507

A SSTI server side template injection vulnerability in the custom template export function in yeti-platform yeti before 2.1.12 allows attackers to execute code on the application server...

Yeti Platform 代码注入漏洞

Yeti Platform is an open-source daily threat intelligence platform developed by Yeti Platform. Versions of Yeti Platform prior to 2.1.12 contained a code injection vulnerability. This vulnerability stemmed from server-side template injection during the custom template export function, which could...

CVE-2024-46507

The yeti-platform yeti (versions prior to 2.1.12 ) is vulnerable to a Server-Side Template Injection (SSTI) flaw located in the custom template export function . This vulnerability allows an attacker to inject malicious template expressions which, when evaluated by the server, can lead to Remote ...

kimai 安全漏洞

Kimai is a web-based, multi-user time tracking application developed by Kimai’s individual developers. Versions of Kimai from 2.27.0 to 2.54.0 contained security vulnerabilities. These vulnerabilities stemmed from the possibility for any ROLEUSER to create tags with formula strings as names using...

CVE-2026-7650: Improper Neutralization of Input During Web Page Generation

The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the e2pdf-download shortcode in all versions up to, and including, 1.32.17. This is due to insufficient input sanitization and output escaping on the shortcode...

CVE-2024-46507: Improper Control of Generation of Code

A SSTI server side template injection vulnerability in the custom template export function in yeti-platform yeti before 2.1.12 allows attackers to execute code on the application server...

CVE-2023-47268

In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code exported...

datacube (1.6.2), osm-export-tool (0.0.17) +1 more potentially affected by CVE-2026-8088 via gdal (2.3.3)

gdal PYPI version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - datacube 1.6.2 - osm-export-tool 0.0.17 - pysy =0.0.8, =0.0.10 Source cves: CVE-2026-8088 Source advisory: OSV:GHSA-J3F5-RW74-G4RV...

evaporation (>=0.1.0, <=1.0.0), hspatial (>=0.1.0, <=2.1.3) +4 more potentially affected by CVE-2026-8088 via gdal (2.4.4)

gdal PYPI version 2.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - evaporation =0.1.0, =0.1.0, =0.0.4, =1.0.16, =0.9.0, =0.9.1 Source cves: CVE-2026-8088 Source advisory: OSV:GHSA-J3F5-RW74-G4RV...

datacube (1.6.2), osm-export-tool (0.0.17) +1 more potentially affected by CVE-2026-8087 via gdal (2.3.3)

gdal PYPI version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - datacube 1.6.2 - osm-export-tool 0.0.17 - pysy =0.0.8, =0.0.10 Source cves: CVE-2026-8087 Source advisory: OSV:GHSA-H9RH-5FFH-H669...

Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leads to Remote Code Execution

Description The Note Mark application allows authenticated users to upload assets to notes via POST /api/notes/noteID/assets, where the asset filename is provided through the X-Name HTTP request header. This value is stored directly in the database without any sanitization or validation - no path...

GHSA-G49P-4QXJ-88V3 Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leads to Remote Code Execution

Description The Note Mark application allows authenticated users to upload assets to notes via POST /api/notes/noteID/assets, where the asset filename is provided through the X-Name HTTP request header. This value is stored directly in the database without any sanitization or validation - no path...

evaporation (>=0.1.0, <=1.0.0), hspatial (>=0.1.0, <=2.1.3) +4 more potentially affected by CVE-2026-8088 via gdal (2.4.4)

gdal PYPI version 2.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - evaporation =0.1.0, =0.1.0, =0.0.4, =1.0.16, =0.9.0, =0.9.1 Source cves: CVE-2026-8088 Source advisory: OSV:PYSEC-2026-2156...

datacube (1.6.2), osm-export-tool (0.0.17) +1 more potentially affected by CVE-2026-8087 via gdal (2.3.3)

gdal PYPI version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - datacube 1.6.2 - osm-export-tool 0.0.17 - pysy =0.0.8, =0.0.10 Source cves: CVE-2026-8087 Source advisory: OSV:PYSEC-2026-2155...

datacube (1.6.2), osm-export-tool (0.0.17) +1 more potentially affected by CVE-2026-8086 via gdal (2.3.3)

gdal PYPI version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - datacube 1.6.2 - osm-export-tool 0.0.17 - pysy =0.0.8, =0.0.10 Source cves: CVE-2026-8086 Source advisory: OSV:PYSEC-2026-2154...

evaporation (>=0.1.0, <=1.0.0), hspatial (>=0.1.0, <=2.1.3) +4 more potentially affected by CVE-2026-8086 via gdal (2.4.4)

gdal PYPI version 2.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - evaporation =0.1.0, =0.1.0, =0.0.4, =1.0.16, =0.9.0, =0.9.1 Source cves: CVE-2026-8086 Source advisory: OSV:PYSEC-2026-2154...

WordPress Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export vulnerability

Missing Authorization to Authenticated Subscriber+ Scheduled Form Submission Export vulnerability discovered by anhcd05 - VNPT Cyber Immunity in WordPress Plugin Forminator versions = 1.53.0...

CVE-2026-6214

The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0. This is due to the listenforsavingexportschedule function in library/class-export.php failing to perform a capability check before saving the scheduled export configuration,...

CVE-2026-6214

CVE-2026-6214 affects Forminator Forms for WordPress (≤ 1.53.0). The issue is in listen_for_saving_export_schedule() in library/class-export.php, which fails to perform a capability check before saving a scheduled export configuration, unlike listen_for_csv_export() that verifies permissions. Thi...

CVE-2026-6214

The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0. This is due to the listenforsavingexportschedule function in library/class-export.php failing to perform a capability check before saving the scheduled export configuration,...