CVE-2026-97305

Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2...

CVE-2026-97070

Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23...

CVE-2026-103085

Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User Manager: from n/a through 2.9.20...

CVE-2026-105652

The Ghost Node.js content management system is vulnerable to a Password Hash Ordering Disclosure in its Admin API. In versions 0.7.2 through 6.64.0 , any user with staff-level privileges could determine the relative ordering of other staff users' hashed passwords. While this vulnerability does no...

CVE-2026-105651

The Ghost Node.js content management system (versions 5.94.0 through 6.64.0 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. When creating a bookmark card, the system could fetch and store non-image files from external websites as icons or thumbnails. This allowed staff users, includi...

CVE-2026-105651 Ghost: Stored XSS via Bookmark Card Images

Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's...

CVE-2026-105651 Ghost: Stored XSS via Bookmark Card Images

Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors, to host arbitrary HTML on the site's...

CVE-2026-105649 Ghost: Stored XSS via SVG Uploads Bypassing Sanitization

Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in...

CVE-2026-105649 Ghost: Stored XSS via SVG Uploads Bypassing Sanitization

Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in...

CVE-2024-1512

إثبات المفهوم لـ CVE-2024-1512 نظرة عامة على الثغرة تكشف CVE-2024-1512 عن ثغرة أمنية حرجة في إضافة MasterStudy LMS لـ WordPress، وتحديداً في تنفيذ مسار REST /lms/stm-lms/order/items. تنشأ المشكلة من فشل الإضافة في تهريب المعامل 'user' بشكل صحيح، بالإضافة إلى إعداد غير كافٍ لاستعلامات SQL. نتيجة...

CVE-2026-105643 Ghost: Stored XSS via Embed Card Previews

Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could bypass protections against stored cross-site scripting. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the pos...

OverlayFS---CVE-2021-3493

TL;DR यह जानें कि OverlayFS में एक कमजोरी कैसे Ubuntu के स्थानीय उपयोगकर्ताओं को रूट विशेषाधिकार प्राप्त करने देती है। कमजोरी का सारांश लिनक्स कर्नेल में overlayfs फाइल सिस्टम से संबंधित एक Ubuntu-विशिष्ट समस्या, जहाँ यह उपयोगकर्ता नेमस्पेस के संबंध में फाइल सिस्टम क्षमताओं capabilities के...

CVE-2026-105642 Ghost: Remote Code Execution via Bookmark Card Images

Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary...

CVE-2026-105642 Ghost: Remote Code Execution via Bookmark Card Images

Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary...

CVE-2026-34213

CVE-2026-34213 एक कम-विशेषाधिकार प्राप्त Docmost उपयोगकर्ता किसी पीड़ित के attachmentId को सामान्य अपलोड एंडपॉइंट पर प्रदान कर सकता था और उसी कार्यक्षेत्र में किसी अन्य पृष्ठ के संग्रहीत अनुलग्नक को अधिलेखित कर सकता था। परिचय मैंने Docmost , ओपन-सोर्स सहयोगी दस्तावेज़ीकरण प्लेटफ़ॉर्म में एक...

EUVD-2026-92616

In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-92613

In cfg2prop of btifstorage.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2021-43408

CVE-2021-43408: वर्डप्रेस प्लगइन डुप्लिकेट पोस्ट संस्करण 1.1.9 - SQL इंजेक्शन I. अवलोकन 1. वर्डप्रेस क्या है वर्डप्रेस एक ओपन सोर्स CMS सामग्री प्रबंधन प्रणाली सॉफ्टवेयर है, जो एक सामग्री प्रबंधन प्रणाली है। HTML एन्कोडिंग भाषा का उपयोग करने के बजाय, WP PHP प्रोग्रामिंग भाषा में लिखा गया है जो...

CVE-2025-64446-FortiWeb-CGI-Bypass-PoC

CVE-2025-64446 शोषण उपकरण FortiWeb उपकरणों में CVE-2025-64446 भेद्यता सत्यापन और शोषण के लिए शोषण उपकरण। विवरण यह उपकरण FortiWeb वेब एप्लिकेशन फायरवॉल में पथ ट्रैवर्सल भेद्यता CVE-2025-64446 का परीक्षण और शोषण करता है। इसका उपयोग भेद्यता स्थिति सत्यापित करने या उपयोगकर्ता खाते बनाने/संशोधित करने ...

CVE-2026-97305 WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2...