CVE-2026-105123 W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-75828

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers...

CVE-2026-75828: Improper Neutralization of Input During Web Page Generation

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers...

CVE-2026-15601 Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal Zip Slip in all versions up to, and including, 6.0.13 via the extractzipfile function. This makes it possible for authenticated attackers, with custom-level access and above, to...

CVE-2026-15601

The CVE affects the Kirki plugin for WordPress (versions

EUVD-2026-44634

n8n: External Secrets Accessible via Workflow Expressions Outside Credentials...

EUVD-2026-42613

n8n: Shared Credential Header Leak via HTTP Request Pagination Expression...

CVE-2026-15457

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via the 'family' parameter. This makes it possible for authenticated attackers, with editor-level access and above, to delete...

CVE-2026-15457

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via the 'family' parameter. This makes it possible for authenticated attackers, with editor-level access and above, to delete...

CVE-2026-15457 Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via the 'family' parameter. This makes it possible for authenticated attackers, with editor-level access and above, to delete...

CVE-2026-15457 Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via the 'family' parameter. This makes it possible for authenticated attackers, with editor-level access and above, to delete...

CVE-2026-62237

Grav before 2.0.4 contains a regular expression denial of service ReDoS vulnerability in the regexreplace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled security.twigcontent.processenabled: true, disabled by default, an...

CVE-2026-62237 Grav < 2.0.4 ReDoS via regex_replace in Sandbox

Grav before 2.0.4 contains a regular expression denial of service ReDoS vulnerability in the regexreplace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled security.twigcontent.processenabled: true, disabled by default, an...

CVE-2026-62237 Grav < 2.0.4 ReDoS via regex_replace in Sandbox

Grav before 2.0.4 contains a regular expression denial of service ReDoS vulnerability in the regexreplace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled security.twigcontent.processenabled: true, disabled by default, an...

CVE-2026-45806

Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot's remote image import passed the user-controlled url from frontend/src/app/main/data/workspace/media.cljs into the backend RPC method :create-file-media-object-from-url in...

GHSA-3J7V-FHJG-6RH2 Duplicate Advisory: n8n: External Secrets Accessible via Workflow Expressions Outside Credentials

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2434-3x6q-8r99. This link is maintained to preserve external references. Original Description n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in...

Duplicate Advisory: n8n: External Secrets Accessible via Workflow Expressions Outside Credentials

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2434-3x6q-8r99. This link is maintained to preserve external references. Original Description n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in...

CVE-2026-59254

n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressions outside credentials scope. Authenticated project editors can read plaintext external secret values by referencing them in node expressions without...

CVE-2026-59254

n8n vulnerability CVE-2026-59254 affects n8n before 2.28.1, where external secrets are incorrectly resolved in workflow node expressions outside the credentials scope. The flaw allows authenticated project editors to read plaintext external secret values by referencing them in node expressions wi...

PT-2026-60131

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.28.1 Description An information disclosure issue exists where external secrets are incorrectly resolved in workflow node expressions outside the credentials scope. Authenticated project editors can read plaintext extern...