CVE-2026-82348: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring rights on one weblog to read, modify, or delete resources belonging to another weblog through unscoped identifier-based lookups. This affects multi-user installations where users ar...

PT-2026-99792

Name of the Vulnerable Software and Affected Versions Apache Roller version 6.1.5 Description An issue allows a weblog administrator to read files on the application classpath, including configuration files containing secrets. This occurs when a Velocity template is authored using an include...

CVE-2026-101057 utcp-mcp before 1.1.3 SSRF via unvalidated MCP server URL

utcp-mcp the MCP plugin of python-utcp through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a call template's mcpServers configuration without the ensuresecureurl validation that the HTTP-family plugins apply, so the HTTPS/WSS-or-loopback rule is not enforced. A call template...

EUVD-2026-87982

utcp-mcp the MCP plugin of python-utcp through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a call template's mcpServers configuration without the ensuresecureurl validation that the HTTP-family plugins apply, so the HTTPS/WSS-or-loopback rule is not enforced. A call template...

Exploit for CVE-2026-12227

CVE-2026-12227: Visual Composer Website Builder Unauthenticated...

CVE-2026-29053

CVE-2026-29053 - Ghost CMS 受影响： Ghost 0.7.2 至 6.19.0 已修复： Ghost 6.19.1 CWE： CWE-74 — 下游组件使用的输出中特殊元素的不当中和 Ghost 的公告将此问题描述为通过恶意主题实现任意代码执行。 漏洞是什么？ Ghost 主题使用 Handlebars 模板 （.hbs）。 特制的模板可以滥用 Ghost 处理 Handlebars 表达式的方式，访问本不应从普通主题模板触及的 JavaScript 功能。 利用的关键部分是模板表达式： get "posts" filter="tags:page?...

CVE-2026-84097 WP Review Slider Pro < 12.7.12 - Subscriber+ SQLi via Stored Template Filter

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are...

CVE-2026-84097 WP Review Slider Pro < 12.7.12 - Subscriber+ SQLi via Stored Template Filter

The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are...

CLEANSTART-2026-DF36684 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...

Security vulnerability affects the loki package. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block...

PT-2026-99362

Name of the Vulnerable Software and Affected Versions Hugo versions 0.75.0 through 0.165.x Description A stored cross-site scripting issue exists because the syntax highlighter fails to escape the lineAnchors option before passing it to Chroma. This causes the value to be written verbatim into th...

WordPress 7.1.1 Path Traversal Checker

This diagnostic checker identifies whether WordPress versions 4.7.0 through 7.1.1 are exposed to an unauthenticated page-template path traversal issue and reports related compromise indicators...

CVE-2026-63432

Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the getmailpreview handlers in recruitment/views/actions.py and employee/notinoutdashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object i...

CVE-2026-63432 Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server Metadata

Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the getmailpreview handlers in recruitment/views/actions.py and employee/notinoutdashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object i...

CVE-2026-63432 Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server Metadata

Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the getmailpreview handlers in recruitment/views/actions.py and employee/notinoutdashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object i...

CVE-2026-63432 Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server Metadata

Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the getmailpreview handlers in recruitment/views/actions.py and employee/notinoutdashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object i...

EUVD-2026-87363

Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the getmailpreview handlers in recruitment/views/actions.py and employee/notinoutdashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object i...

CVE-2026-63432

The Horilla HR and CRM software (versions 1.0.0 until 1.6.0 and 2.0.0) contains a Server-Side Template Injection (SSTI) vulnerability. The get_mail_preview handlers in recruitment/views/actions.py and employee/not_in_out_dashboard.py render user-controlled content while including the full request...

CVE-2026-100372

ClipBucket v5 before 5.5.3-197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with managetemplateaccess permission can traverse outsi...

CVE-2026-100372

ClipBucket v5 versions prior to 5.5.3-#197 are vulnerable to a path traversal vulnerability within the admin template editor. Authenticated users with manage_template_access permissions can exploit the folder parameter by providing directory traversal sequences to move outside the layout director...

EUVD-2026-87315

ClipBucket v5 before 5.5.3-197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with managetemplateaccess permission can traverse outsi...