CVE-2026-27067 WordPress Mobile App Editor plugin <= 1.3.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Syarif Mobile App Editor mobile-app-editor allows Upload a Web Shell to a Web Server.This issue affects Mobile App Editor: from n/a through = 1.3.1...

CVE-2026-27067

Unrestricted Upload of File with Dangerous Type vulnerability in Syarif Mobile App Editor allows Upload a Web Shell to a Web Server.This issue affects Mobile App Editor: from n/a through 1.3.1...

CVE-2026-27067

CVE-2026-27067 concerns the WordPress plugin Mobile App Editor (WordPress to Android App Builder) versions up to and including 1.3.1. The issue is an Unrestricted Upload of File with Dangerous Type , enabling an attacker to upload a Web Shell to the web server. The vulnerability is documented in ...

CVE-2026-27067 WordPress Mobile App Editor plugin <= 1.3.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Syarif Mobile App Editor allows Upload a Web Shell to a Web Server.This issue affects Mobile App Editor: from n/a through 1.3.1...

CVE-2026-27068

creationtimestamp| type| source ---|---|--- 2026-03-19 08:16:18+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-27068 2026-03-19 11:59:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhfx7t5aji2d...

Unauthenticated remote shutdown in nltk.app.wordnet_app

Summary nltk.app.wordnetapp allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when it is started in its default mode. A simple GET /SHUTDOWN%20THE%20SERVER request causes the process to terminate immediately via os.exit0, resulting in a denial of service. Details The...

EUVD-2026-13025

OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypass exec approval checks. Attackers with operator.write privileges and a paired macOS beta node can craft shell-chain payloads that pass...

CVE-2026-31993 OpenClaw < 2026.2.22 - Allowlist Parsing Mismatch in system.run Shell Chains

OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypass exec approval checks. Attackers with operator.write privileges and a paired macOS beta node can craft shell-chain payloads that pass...

WordPress plugin Mobile App Editor 代码问题漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

CVE-2026-27979

A denial of service flaw has been discovered in Next.js. A request containing the next-resume: 1 header corresponding with a PPR resume request would buffer request bodies without consistently enforcing maxPostponedStateSize in certain setups. The previous mitigation protected minimal-mode...

GHSA-GFWX-W7GR-FVH7 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nltk

Summary nltk.app.wordnetapp contains a reflected cross-site scripting issue in the lookup... route. A crafted lookup URL can inject arbitrary HTML/JavaScript into the response page because attacker-controlled word data is reflected into HTML without escaping. This impacts users running the local...

web-app-security-project

🛡️ Web Application Security Project 📌 Overview This projec...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to arbitrary code execution (GHSA-5c6j-r48x-rmvq)

Summary Node.js module serialize-javascript is used by IBM App Connect Enterprise Certified Container DesignerAuthoring operands. DesignerAuthoring operands are vulnerable to arbitrary code execution. This bulletin provides patch information to address the reported vulnerability in Node.js module...

CVE-2026-32694

In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictable XID of the secret to verify ownership. This allows a malicious grantee which can request secrets to predict past secrets granted by the...

MAL-2026-1847 Malicious code in signer-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b301c6e6ca05f396b336ffb3bf41042d7ea226645dc1f455ca12e7f6ff04f01 The package signer-app was found to contain malicious code...

Malicious code in signer-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b301c6e6ca05f396b336ffb3bf41042d7ea226645dc1f455ca12e7f6ff04f01 The package signer-app was found to contain malicious code...

Malicious code in proleis-web-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afd065de5d26ebde43c9fef2003ea3ffbc21bfa47120965cf1c6a893da876d33 The package proleis-web-app was found to contain malicious code...

MAL-2026-1825 Malicious code in proleis-web-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afd065de5d26ebde43c9fef2003ea3ffbc21bfa47120965cf1c6a893da876d33 The package proleis-web-app was found to contain malicious code...

CVE-2026-32694 Insecure Direct Object Reference attack via predictable secret ID in Juju

In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictable XID of the secret to verify ownership. This allows a malicious grantee which can request secrets to predict past secrets granted by the...

Malicious code in @emerald-react/app-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba1bef759f7319b0aca58864ce4ec92e4c9b2ac5a5fc166d8c4b5b755e9e2128 The package @emerald-react/app-header was found to contain malicious code...