541 matches found
EUVD-2026-60924
Contributor Cross Site Scripting XSS in WPZOOM Forms – Contact Form Plugin for Gutenberg = 2.0.4 versions...
Pheditor 2.0.1-2.0.3 - OS Command Injection
Pheditor 2.0.1 to - 2.0.4 contains an OS command injection caused by improper sanitization of the 'dir' POST parameter in the terminal action handler, letting authenticated users execute arbitrary OS commands with web server privileges. id: CVE-2026-48030 info: name: Pheditor 2.0.1-2.0.3 - OS...
CVE-2026-65517
Unauthenticated Cross Site Scripting XSS in Easy PayPal Buy Now Button = 2.0.4 versions...
WordPress Easy PayPal Buy Now Button plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Easy PayPal Buy Now Button versions = 2.0.4...
CVE-2026-48030
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST...
GHSA-9643-6XJP-VX57 Pheditor has an authenticated terminal command whitelist bypass
Summary Pheditor 2.0.4 has an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINALCOMMANDS values, then passes the full command string to shellexec. Shell command substitution such as $ is not blocked...
Linux Distros Unpatched Vulnerability : CVE-2026-14373
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Nomad and Nomad Enterprise did not enforce the allowprivileged restriction for the Docker task driver's host namespace mode options. This may allow an...
Symlink Attack
Overview Affected versions of this package are vulnerable to Symlink Attack via the Docker task driver when a job submitter is able to bind-mount a host path into a container despite volume bind mounts being disabled. An attacker can gain unauthorized access to read and write files on the host...
Security Bulletin: Nomad vulnerable to cross-namespace host volume claim deletion
Summary HashiCorp Nomad and Nomad Enterprise are vulnerable to a cross-namespace authorization bypass in the dynamic host volumes feature that may allow an operator holding the host volume delete permission in one namespace to delete a sticky volume claim belonging to a job in another namespace...
CVE-2026-14891
HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job submitter to bind-mount a host path into a container even when volume bind mounts are disabled, potentially leading to reading and writing files on the host. This vulnerability,...
CVE-2026-14891 Nomad vulnerable to sandbox escape in Docker task driver
HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job submitter to bind-mount a host path into a container even when volume bind mounts are disabled, potentially leading to reading and writing files on the host. This vulnerability,...
Security Bulletin: Nomad Docker driver Linux host namespace bypass
Summary HashiCorp Nomad and Nomad Enterprise did not enforce the allowprivileged restriction for the Docker task driver's host namespace mode options. This may allow an authenticated job submitter to run a container in a host namespace and access information belonging to the host or to other...
EUVD-2026-42349
HashiCorp Nomad and Nomad Enterprise did not enforce the allowprivileged restriction for the Docker task driver's host namespace mode options. This may allow an authenticated job submitter to run a container in a host namespace and access information belonging to the host or to other workloads on...
CVE-2026-14373 Nomad Docker driver Linux host namespace bypass
HashiCorp Nomad and Nomad Enterprise did not enforce the allowprivileged restriction for the Docker task driver's host namespace mode options. This may allow an authenticated job submitter to run a container in a host namespace and access information belonging to the host or to other workloads on...
CVE-2026-37271
CVE-2026-37271 affects Fire-Boltt Smartwatch FB BGS001 (Firmware MOY-JS14-2.0.4). The issue is improper authentication: the device accepts GATT Write Request commands without sufficient authentication or strong session validation. Under certain conditions, previously captured BLE packets can be r...
EUVD-2026-39332
Redis Lua HEAP overflow in cjson library vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 2.0.4 through 2.15.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue...
CVE-2026-7547
The Woosa – Marktplaats for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in versions up to and including 2.0.4. This is due to insufficient path sanitization in the renderlogsui function, which accepts a base64-encoded file name from the 'logfile' GET...
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection via the dir parameter in the terminal handler process. An attacker can execute arbitrary operating system commands with web server privileges by injecting shell metacharacters into the dir parameter, bypassing command...
CVE-2026-8599
The MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Campaign HTML Content Field in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This makes...
CVE-2026-8599
The CVE covers the WordPress plugin MailerPress (Email Marketing, Newsletter, Email Automation & WooCommerce Emails) with stored XSS in Campaign HTML Content Field across versions up to 2.0.4. Exploitation requires author-level access (authenticated, Author+), and affects pages loaded in the admi...