CVE-2026-91024 Booking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid)

The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control...

CVE-2026-91024

The Booking Manager WordPress plugin (versions before 2.1.21 ) is vulnerable to SQL injection due to improper neutralization of special elements. The root cause is the failure to sanitize and escape values retrieved from a fetched external iCalendar feed before incorporating them into a SQL query...

Linux Distros Unpatched Vulnerability : CVE-2026-63273

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from...

Linux Distros Unpatched Vulnerability : CVE-2026-63274

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's o...

Fedora 45 : postgresql16-anonymizer (2026-bc7408de42)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bc7408de42 advisory. Upstream changelog: https://gitlab.com/dalibo/postgresqlanonymizer/-/releases - core CVE-2026-19633: Escalation via custom types, operators and...

CVE-2026-88416

MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature...

cve-2025-54313

cve-2025-54313 Checks projects for compromised packages, suspicious files, and import statements, see is Supply Chain attack How? Just execute the script in the terminal/console. Consider to install maple first. root@kitploit: npm install -g maple chmod +x cve-2025-54313.sh ./cve-2025-54313.sh...

CVE-2025-9215

StoreEngine Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More = 1.4.0 - Authenticated Subscriber+ Arbitrary File Download The StoreEngine plugin contains a vulnerability in its CSV Import/Export feature that allows any authenticated user subscriber, author,...

CVE-2026-83803

Sentry is an error tracking and performance monitoring tool. From 23.11.0 until 26.7.0, Sentry instances with the relocation feature enabled unsafely deserialize a legacy database field while importing a user-supplied relocation archive. An authenticated user can craft an archive that causes...

CVE-2021-46364

CVE-2021-46364: YAML Deserialization in Magnolia CMS Magnolia versions =6.2.3 has a Snake YAML parser which is vulnerable to deserialization attacks that can allow an attacker to call arbitrary Java constructors when importing YAML files. Remote Code Execution has been achieved using this...

CVE-2026-83803

The error tracking and performance monitoring tool Sentry versions 23.11.0 until 26.7.0 is vulnerable to arbitrary code execution. When the relocation feature is enabled, the application unsafely deserializes a legacy database field during the import of a user-supplied relocation archive. An auth...

EUVD-2026-84552

Sentry is an error tracking and performance monitoring tool. From 23.11.0 until 26.7.0, Sentry instances with the relocation feature enabled unsafely deserialize a legacy database field while importing a user-supplied relocation archive. An authenticated user can craft an archive that causes...

CVE-2026-45806

CVE-2026-45806 Penpot's remote image import let an authenticated file editor turn a normal media convenience feature into backend-origin SSRF because attacker-controlled URLs crossed into a redirect-following server fetch path without destination filtering. Intro I found this issue while reviewin...

CVEs

CVE-2022-2992: Remote Command Execution via Github import Information Description: This allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint. Versions Affected: all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 Version Fixed:...

DEBIAN-CVE-2026-63274

LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the...

CVE-2026-63274

LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the...

WordPress WP Import Export Lite plugin < 3.9.35 - Authenticated Privilege Escalation vulnerability

Authenticated Privilege Escalation vulnerability discovered by mak3breadMinseong Kim in WordPress Plugin WP Import Export Lite versions 3.9.35...

WordPress Import and export users and customers plugin < 2.5.2 - Custom Role Privilege Escalation to Administrator vulnerability

Custom Role Privilege Escalation to Administrator vulnerability discovered by BINESH MADHARAPU in WordPress Plugin Import and export users and customers versions 2.5.2...

CVE-2026-63279 Out of bounds read in PICT image import

LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the palette has, so an index past the las...

CVE-2026-63279 Out of bounds read in PICT image import

LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the palette has, so an index past the las...