1077 matches found
CVE-2026-70436
Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check 1.4.0 and earlier or performs an improper permission check 1.4.1 when providing access to externally-managed workspaces through the workspace browser, allowing attackers with Overall/Read permission to...
Nacos <1.4.1 - Authentication Bypass
Nacos before version 1.4.1 is vulnerable to authentication bypass because the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint i...
NPM: Valibot: record() issue paths can make flatten() throw for inherited Object property names
NPM: Valibot: record issue paths can make flatten throw for inherited Object property names vulnerability discovered by ? in WordPress Npm valibot versions = 1.4.1...
CVE-2026-46410
FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable and 1.4.1-beta may leak some sensitive info, such as source and path. Versions 1.3.2-stable and 1.4.1-beta fix the issue. No known workarounds are available...
CVE-2026-46410 FileBrowser Quantum: unauthenticated user share share info
FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable and 1.4.1-beta may leak some sensitive info, such as source and path. Versions 1.3.2-stable and 1.4.1-beta fix the issue. No known workarounds are available...
CVE-2026-16222
A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.1. This issue affects some unknown processing of the file backend/crm/src/main/java/cn/cordys/crm/integration/sso/service/TokenService.java of the component Third Party Endpoint. Performing a manipulation of the argument mkAddress result...
CVE-2026-16222 1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery
A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.1. This issue affects some unknown processing of the file backend/crm/src/main/java/cn/cordys/crm/integration/sso/service/TokenService.java of the component Third Party Endpoint. Performing a manipulation of the argument mkAddress result...
GHSA-52MM-H59V-F3C7 earmark: Stored XSS via unescaped HTML attribute values
Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values. 'Elixir.Earmark.Transform':makeatt1/2 in lib/earmark/transform.ex splices attribute values verbatim between two literal " bytes: ...
CVE-2026-48591 Stored XSS via unescaped HTML attribute values in earmark
Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values. 'Elixir.Earmark.Transform':makeatt1/2 in lib/earmark/transform.ex splices attribute values verbatim between two literal " bytes: ...
CVE-2026-40738
Unauthenticated PHP Object Injection in Eldon = 1.4.1 versions...
CVE-2025-69111
Unauthenticated PHP Object Injection in Reisen = 1.4.1 versions...
CVE-2026-39577
Unauthenticated PHP Object Injection in Playroom = 1.4.1 versions...
CVE-2026-27429
Unauthenticated PHP Object Injection in Nifty = 1.4.1 versions...
CVE-2026-40738 WordPress Eldon theme <= 1.4.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Eldon = 1.4.1 versions...
CVE-2025-69111 WordPress Reisen theme <= 1.4.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Reisen = 1.4.1 versions...
CVE-2026-27429
CVE-2026-27429 concerns the WordPress Nifty theme (versions
CVE-2026-27429 WordPress Nifty theme <= 1.4.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Nifty = 1.4.1 versions...
CVE-2026-40809
Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Metro Magazine: from n/a through 1.4.1...
CVE-2026-40809 WordPress Metro Magazine theme <= 1.4.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Metro Magazine: from n/a through 1.4.1...