CVE-2026-92980

HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability in its Import/Export functionality. The feature, intended solely for data portability, can be abused by authenticated administrators to deploy and execute arbitrary OS commands as the web server user on the underlyi...

CVE-2026-92980 HortusFox-Web < 6.1 Remote Code Execution via Import/Export

HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, which is intended solely...

EUVD-2026-81910

HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, which is intended solely...

CVE-2026-92980 HortusFox-Web < 6.1 Remote Code Execution via Import/Export

HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, which is intended solely...

CVE-2026-92980 HortusFox-Web < 6.1 Remote Code Execution via Import/Export

HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, which is intended solely...

CVE-2026-87836

The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commente...

CVE-2026-87836 Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export

The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commente...

CVE-2026-87836 Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export

The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commente...

WordPress Comments Import & Export plugin 2.1.11-2.5.3 - Author+ Comment PII Disclosure vulnerability

Author+ Comment PII Disclosure vulnerability discovered by a0yark in WordPress Plugin Comments Import & Export versions 2.1.11-2.5.3...

EUVD-2026-81345

The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commente...

CVE-2026-87836

The Comments Import & Export WordPress plugin versions 2.1.11 through 2.5.3 is vulnerable to an unauthorized information disclosure. The plugin fails to restrict comment exports to users with moderation capabilities or scope them to content owned by the requesting user. This allows users with the...

CVE-2026-92980: Unrestricted Upload of File with Dangerous Type

HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, which is intended solely...

PT-2026-94834

Name of the Vulnerable Software and Affected Versions HortusFox-Web versions prior to 6.1 Description Authenticated administrators can execute arbitrary operating system commands as the web server user by abusing the Import/Export functionality. This feature, designed for data portability, can be...

CVE-2026-87836: Exposure of Sensitive Information to an Unauthorized Actor

The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commente...

PT-2026-94672

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where the import ubuf function can fail if the address range provided by the userspace ublk server is outside the allowed user address space. When this failure occurs, th...

PT-2026-94169

Name of the Vulnerable Software and Affected Versions Comments Import & Export versions prior to 2.5.4 Description The plugin fails to restrict the comment export feature to users with comment moderation privileges and does not limit the export to content owned by the requesting user. This allows...

CVE-2026-61599

djust is a Django extension providing Phoenix LiveView-style reactive server-side rendering with Rust-powered performance. Prior to version 1.0.7 , the live transport resolves the LiveView to mount from a client-supplied dotted path by calling __import__(), executing a module's top-level code bef...

CVE-2026-61599 djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its...

EUVD-2026-81307

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its...

CVE-2026-61599 djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its...