840 matches found
CVE-2016-2555
CVE-2016-2555 Exploit This exploit targets a SQL Injection vulnerability and an authentication weakness vulnerability in ATutor 2.2.1. By exploiting these vulnerabilities, the attacker can upload malicious code to achieve Remote Code Execution RCE on the vulnerable server. Usage root@kitploit: $...
CLSA-2026-1789465375 TuxCare security update for launch-editor (2 CVEs)
TuxCare rebuilt launch-editor to address 2 CVEs. Fixed in 2.2.1-tuxcare.1...
CVE-2026-85690
Plandex 2.2.1 is vulnerable to a path traversal in the ApplyFiles function, which allows files to be written outside the project directory. Attackers can influence model output through poisoned repository files or attacker-controlled context to write to sensitive locations such as shell rc or cro...
EUVD-2026-71139
Plandex 2.2.1 contains a path traversal vulnerability in the ApplyFiles function that allows attackers to write files outside the project directory. Attackers can influence model output through poisoned repository files or attacker-controlled context to write to arbitrary locations like shell rc ...
PT-2026-85576
Plandex 2.2.1 contains a path traversal vulnerability in the ApplyFiles function that allows attackers to write files outside the project directory. Attackers can influence model output through poisoned repository files or attacker-controlled context to write to arbitrary locations like shell rc ...
CVE-2026-84766
Unauthenticated Bypass Vulnerability in FluentBooking Pro = 2.2.1 versions...
CVE-2026-81205: Improper Neutralization of Special Elements used in an LDAP Query
Improper Neutralization of Special Elements used in an LDAP Query 'LDAP Injection' vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1...
CVE-2026-72843
EverShop 's updateCustomer route (packages/evershop/src/modules/customer/api/updateCustomer/route.json) is declared "access": "public", so the admin auth middleware calls next() without verifying the caller and no session guard protects the route. The handler in updateCustomer.js loads a customer...
CVE-2026-63384 Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value.
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in eventtagging.c when evtagunmarshalheader uses evtagdecodeint to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INTMAX becom...
CVE-2026-74020
CVE-2026-74020 is an unauthenticated Broken Access Control vulnerability in the WordPress Koji theme , affecting versions ≤ 2.2.1 . The flaw allows a remote, unauthenticated attacker to access restricted resources over the network with low complexity, resulting in a high confidentiality impact (C...
PT-2026-78993
Name of the Vulnerable Software and Affected Versions Koji versions prior to 2.2.2 Description An unauthenticated broken access control issue exists, allowing users to bypass authorization mechanisms without providing valid credentials. Recommendations Update to a version newer than 2.2.1...
CVE-2026-73189
Subscriber Insecure Direct Object References IDOR in WP Crowdfunding 2.2.1 versions...
CLEANSTART-2026-LB37339 Security fixes in kubernetes-csi-external-resizer-fips 2.2.1-r1
Package kubernetes-csi-external-resizer-fips version 2.2.1-r1 fixes 1 vulnerabilities: CVE-2026-46600...
CLSA-2026-1784769544 TuxCare security update for protobufjs (8 CVEs)
TuxCare rebuilt protobufjs to address 8 CVEs. Fixed in 2.2.1-tuxcare.1...
CLSA-2026-1776731779 TuxCare security update for useragent (1 CVE)
TuxCare rebuilt useragent to address 1 CVE. Fixed in 2.2.1-tuxcare.1...
CLSA-2026-1775003175 TuxCare security update for underscore.string (1 CVE)
TuxCare rebuilt underscore.string to address 1 CVE. Fixed in 2.2.1-tuxcare.1...
CVE-2026-14834 Mailgun for WordPress < 2.2.1 - Unauthenticated Arbitrary Mailgun List Subscription via add_list AJAX
The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the site owner's configured email service mailing lists, allowing unauthenticated attackers to enrol arbitrary email addresses into those lists...
CVE-2026-14834
The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the site owner's configured email service mailing lists, allowing unauthenticated attackers to enrol arbitrary email addresses into those lists...