7672 matches found
CVE-2026-65608 Grav before 2.0.9 Remote Code Execution via FlexDirectory
Grav versions = 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField resolves blueprint data-@: directives by calling calluserfuncarray on attacker-influenced input, validating only that the target is callable iscallable without restricting dangero...
EUVD-2026-48101
Unauthenticated Sensitive Data Exposure in Create by Mediavine = 2.5.3 versions...
CVE-2026-65490 WordPress Create by Mediavine plugin <= 2.6.0 - Sensitive Data Exposure vulnerability
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in John-Michael L'Allier Create mediavine-create allows Retrieve Embedded Sensitive Data.This issue affects Create: from n/a through 2.6.0...
CVE-2026-65490
Unauthenticated Sensitive Data Exposure in Create by Mediavine = 2.5.3 versions...
CVE-2026-65490
The CVE-2026-65490 entry concerns the WordPress plugin Create by Mediavine (versions <= 2.5.3), with unauthenticated sensitive data exposure identified. The connected records confirm the affected software (Create by Mediavine plugin) and the version bound (
CVE-2026-24552 WordPress Create by Mediavine plugin <= 2.5.3 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in John-Michael L'Allier Create mediavine-create allows Blind SQL Injection.This issue affects Create: from n/a through 2.5.3...
CVE-2026-24552 WordPress Create by Mediavine plugin <= 2.5.3 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in John-Michael L'Allier Create mediavine-create allows Blind SQL Injection.This issue affects Create: from n/a through 2.5.3...
CVE-2026-24552
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in John-Michael L'Allier Create allows Blind SQL Injection. This issue affects Create: from n/a through 2.5.3...
CVE-2026-24552
CVE-2026-24552 concerns the WordPress plugin “Create by Mediavine” (versions
EUVD-2026-48144
Contributor SQL Injection in Create by Mediavine = 2.5.3 versions...
Malicious code in create-kumo-project (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 172586ef83140a92d732376efb734e45aa09958a7800016aa3c229ccf74c81bf Package presents itself as a create--project scaffolder but ships no scaffolding functionality. The bin/run.js entry, invoked when a user runs npx...
CVE-2026-65897: Improper Privilege Management
Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership,...
CVE-2026-65490: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in John-Michael L'Allier Create mediavine-create allows Retrieve Embedded Sensitive Data.This issue affects Create: from n/a through 2.6.0...
PT-2026-63911
Unauthenticated Sensitive Data Exposure in Create by Mediavine = 2.5.3 versions...
CVE-2026-24552: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in John-Michael L'Allier Create mediavine-create allows Blind SQL Injection.This issue affects Create: from n/a through 2.5.3...
The vulnerability of the __smc_create() function in the net/smc/af_smc.c module of the Linux operating system allows a hacker to cause a service failure.
The vulnerability of the smccreate function in the net/smc/afsmc.c module of the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability can allow an attacker to cause a service failure...
PT-2026-63802
Contributor SQL Injection in Create by Mediavine = 2.5.3 versions...
EUVD-2026-42612
n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration...
GO-2026-6021 File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup in github.com/filebrowser/filebrowser
File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup in github.com/filebrowser/filebrowser...
DRUPAL-CONTRIB-2026-080
This module provides a better UI for managing and selecting Media entities in a folder structure. The module doesn't sufficiently sanitize the names and descriptions of media items and folders when they are displayed in the media browser, resulting in a stored cross-site scripting XSS...