EUVD-2026-2451

BlackSheep is an asynchronous web framework to build event based web applications with Python. Prior to 2.4.6, the HTTP Client implementation in BlackSheep is vulnerable to CRLF injection. Missing headers validation makes it possible for an attacker to modify the HTTP requests e.g. insert a new...

CVE-2026-22779

Summary of public details (CVE-2026-22779) : BlackSheep, a Python asynchronous web framework, has a vulnerable HTTP Client implementation prior to version 2.4.6. The root cause is missing validation of headers, enabling CRLF injection that can modify existing HTTP requests or create new ones when...

CVE-2025-65090 XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService

XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.6, users with the rights to view the Calendar.JSONService page including guest users can exploit the data leak vulnerability by accessing database info, with the exception of passwords. This issue has...

XWiki Full Calendar Macro 信息泄露漏洞

XWiki Full Calendar Macro is an open source log table extension component for XWiki. An information disclosure vulnerability exists in XWiki Full Calendar Macro versions prior to 2.4.6, which originates from a user with permission to view the Calendar.JSONService page may be able to access databa...

PT-2026-1846

Name of the Vulnerable Software and Affected Versions XWiki versions prior to 2.4.6 Description The XWiki Full Calendar Macro displays objects from the wiki on a calendar. Users with permission to view the Calendar.JSONService page, including guest users, can access database information, excludin...

CVE-2025-56225

fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluidsynthmonopoly.c, that can be triggered when loading an invalid midi file...

CVE-2025-56225

fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluidsynthmonopoly.c, that can be triggered when loading an invalid midi file...

CVE-2023-45006

Unauth. Reflected Cross-Site Scripting XSS vulnerability in ByConsole WooODT Lite – WooCommerce Order Delivery or Pickup with Date Time Location plugin = 2.4.6 versions...

CVE-2025-56225

fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluidsynthmonopoly.c, that can be triggered when loading an invalid midi file...

fluidsynth 安全漏洞

fluidsynth is fluidsynth open source an application system . Used to generate audio by using SoundFont by reading and processing MIDI events from MIDI input devices. A security vulnerability exists in fluidsynth 2.4.6 and earlier versions, which stems from a null pointer dereference that may be...

CVE-2025-68076

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Select-Themes Stockholm Core stockholm-core allows Stored XSS.This issue affects Stockholm Core: from n/a through = 2.4.6...

CVE-2025-68076

The CVE-2025-68076 entry concerns the WordPress Stockholm Core plugin (

CVE-2025-68076 WordPress Stockholm Core plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Select-Themes Stockholm Core stockholm-core allows Stored XSS.This issue affects Stockholm Core: from n/a through = 2.4.6...

PT-2025-51456

Name of the Vulnerable Software and Affected Versions Select-Themes Stockholm Core versions through 2.4.6 Description The software contains a flaw due to improper neutralization of input during web page generation, leading to a Cross-site Scripting XSS issue. Specifically, this is a Stored XSS,...

Advisory ROSA-SA-2025-3082

Software: httpd 2.4.6 OS: rosa-server79 unaffected versions = httpd-2.4.6-99.0.7.res7.1 affected versions httpd-2.4.6-99.0.7.res7.1 CVE-ID: CVE-2024-47252 BDU-ID: 2025-08958 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the modssl function of the Apache HTTP Server web server is related to a failu...

CVE-2025-11773 Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO <= 2.4.7 - Missing Authorization to Authenticated (Subscriber+) Contract Address Update

The Cryptocurrency Token, Launchpad Presale, ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveDeployedContract' function in all versions up to, and including, 2.4.7. This makes it possible for...

WordPress plugin Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO 访问控制错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a suite of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. WordPress...

WordPress plugin TokenICO 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

EUVD-2025-38042

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Ido Kobelkowsky Simple Payment simple-payment.This issue affects Simple Payment: from n/a through = 2.4.6...

CVE-2025-62076

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ido Kobelkowsky Simple Payment simple-payment.This issue affects Simple Payment: from n/a through = 2.4.6...