CVE-2026-65442

Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...

CVE-2026-65442

Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...

CVE-2026-65442

The CVE-2026-65442 entry concerns the WordPress FormCraft plugin up to version 3.9.15 with an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. Documentation from multiple sources confirms the affected product (FormCraft) and the vulnerability class (SSRF) but does not provide roo...

CVE-2022-0236

The WP Import Export WordPress plugin both free and premium versions is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpieprocessfiledownload found in the /includes/classes/class-wpie-general.php file. This made it possible for...

EUVD-2020-29286

Malware in sbrugna...

EUVD-2024-0130

Malicious code in bioql PyPI...

CVE-2020-8421

An issue was discovered in Joomla! before 3.9.15. Inadequate escaping of usernames allows XSS attacks in comactionlogs...

Arbitrary Code Injection

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Arbitrary Code Injection via the template rendering engine. An attacker can execute arbitrary code on the server by injecting malicious code into templates that are then executed by the serve...

Fedora 37 : python3.9 (2022-607efb9e65)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-607efb9e65 advisory. The release you're looking at is Python 3.9.15, a security bugfix release for the legacy 3.9 series...

OPENSUSE-SU-2024:12482-1 python39-3.9.15-2.1 on GA media

These are all security issues fixed in the python39-3.9.15-2.1 package on the GA media of openSUSE Tumbleweed...

DEBIAN-CVE-2024-27454

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents...

PYSEC-2024-40

orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents...

PT-2024-21907 · Orjson · Orjson

Name of the Vulnerable Software and Affected Versions: orjson versions prior to 3.9.15 Description: The issue is related to the orjson.loads function in orjson, which does not limit recursion for deeply nested JSON documents. This can lead to potential exploitation. Recommendations: For versions...

Vulnerability fixed in Node.js vm2

A vulnerability has been fixed in vm2. vm2 is a package for Node.js and provides a sandbox environment for running untrusted code. The vulnerability allows a malicious party to to break out of the sandbox and thus execute code on the system on which vm2 is running. The way the vulnerability can b...

GHSA-7JXR-CG7F-GPGV vm2 vulnerable to sandbox escape

vm2 was not properly handling host objects passed to Error.prepareStackTrace in case of unhandled async errors. - vm2 version: 3.9.14 - Node version: 18.15.0, 19.8.1, 17.9.1 Impact A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the...

CVE-2023-29017 vm2 Sandbox Escape vulnerability

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to Error.prepareStackTrace in case of unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code...

Fedora 36 : python3.9 (2022-6c46abfb5a)

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-6c46abfb5a advisory. The release you're looking at is Python 3.9.15, a security bugfix release for the legacy 3.9 series...

CVE-2022-0236

The WP Import Export WordPress plugin both free and premium versions is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpieprocessfiledownload found in the /includes/classes/class-wpie-general.php file. This made it possible for...

CVE-2022-0236

The WP Import Export WordPress plugin both free and premium versions is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpieprocessfiledownload found in the /includes/classes/class-wpie-general.php file. This made it possible for...

Design/Logic Flaw

The WP Import Export WordPress plugin both free and premium versions is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpieprocessfiledownload found in the /includes/classes/class-wpie-general.php file. This made it possible for...