CVE-2026-105676

Ghost, a Node.js content management system , is vulnerable to a path traversal flaw in how it loads theme translation files. Affected versions range from 1.20.0 until 6.64.0 . An authenticated Administrator can exploit this vulnerability to read JSON files outside of the active theme's directory,...

CVE-2026-105676 Ghost: Path Traversal via Locale Setting

Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. This issue is...

CVE-2026-105646 Ghost: Regular Expression Denial of Service in Content Import

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

CVE-2026-105646 Ghost: Regular Expression Denial of Service in Content Import

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

CVE-2026-105645 Ghost: Regular Expression Denial of Service in External Media Inliner

Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

CVE-2026-105645 Ghost: Regular Expression Denial of Service in External Media Inliner

Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

CVE-2022-43959

CVE-2022-43959 Vulnérabilité Bitrix CVE-2022-43959 Description Des identifiants insuffisamment protégés dans les paramètres du serveur AD/LDAP du module connecteur AD/LDAP 1C-Bitrix Bitrix24, avant la version 23.100.0, permettent à des administrateurs distants de découvrir un mot de passe...

CVE-2024-49328

CVE-2024-49328 WP REST API FNS ; rel="https://api.w.org/" X-Content-Type-Options: nosniff Access-Control-Expose-Headers: X-WP-Total, X-WP-TotalPages, Link Access-Control-Allow-Headers:...

CVE-2025-6934

🛡️ CVE-2025-6934 - تصعيد امتيازات غير مصادق عليه في Opal Estate Pro 📝 الوصف إن البرنامج الإضافي Opal Estate Pro – Property Management and Submission لووردبريس، المستخدم في FullHouse - Real Estate Responsive WordPress Theme ، معرض لـ تصعيد الامتيازات في جميع الإصدارات حتى 1.7.5 وما يشملها. معرف CVE...

EUVD-2026-92428

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools launched by the application is insufficient. Before executing a helper tool, the application only verifies that the file carries a valid Authenticode...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nvmet: A possible leak has been fixed when destroying a ctrl during qp establishment. In nvmetsqdestroy, we capture sq-ctrl early. If it is not NULL, we know that a ctrl was allocated during the admin connect request handling. We...

CVE-2021-37580

CVE-2021-37580 تجاوز مصادقة المسؤول في Apache ShenYu...

CVE-2026-74252

ثغرة XSS مخزنة في J2Commerce عند إتمام الشراء كضيف عبر تجاوز فلتر الكوكيز J2Commerce comj2store ≤ 4.1.5 — مهاجم غير مصادَق يخزّن حمولة XSS يتم تنفيذها تلقائيًا في متصفح المسؤول عند تحميل الصفحة الملخص الإصدار 4.1.5 من J2Commerce عرضة لثغرة XSS مخزنة Stored XSS من خلال حقول عنوان الفوترة في إتمام...

CVE-2026-105302

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

EUVD-2026-92257

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

CVE-2026-105302

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

CVE-2025-39596

CVE-2025-39596 Quentn WP -e options Arguments obligatoires : -u, --url URL du site WordPress cible ex. http://127.0.0.1/wordpress -e, --email Email pour le nouveau compte administrateur Arguments facultatifs : -f, --fname Prénom défaut : Pwn -l, --lname Nom défaut : Admin -r, --role Rôle à...

CVE-2020-18326

Subrion CMS 4.2.1 - تزوير الطلبات عبر المواقع CSRF إضافة مستخدم مسؤول الوصف يسهل تثبيت Subrion CMS وإدارته. استخدمه كتطبيق مستقل أو بالاقتران مع تطبيقات أخرى لإنشاء مواقع للمستوى المبتدئ أو مواقع متوسطة أو كبيرة الحجم. توجد ثغرة تزوير الطلبات عبر المواقع CSRF في Intelliants Subrion CMS الإصدار...

CVE-2025-39459

CVE-2025-39459 Real Estate 7 = 3.5.2 - تصعيد الامتيازات دون مصادقة 🧨 CVE-2025-39459 — Real Estate 7 = 3.5.2 تصعيد الامتيازات دون مصادقة 📌 نظرة عامة يحتوي هذا المستودع على أداة إثبات مفهوم مكتوبة بلغة Python لثغرة CVE-2025-39459 ، التي تؤثر على قالب ووردبريس Real Estate 7 في الإصدارات = 3.5.2. تسم...

PT-2026-106179

Name of the Vulnerable Software and Affected Versions Ghost versions 5.37.0 through 6.66.0 Description A crafted request to the external media inliner can lead to excessive CPU usage, resulting in the server becoming unresponsive. This issue requires Administrator access to be exploited...