Lucene search
+L

57614 matches found

EUVD
EUVD
added 4 days ago10 views

EUVD-2026-51795

The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the maybeupdateuserrole function passing an attacker-controlled Gravity Forms field value $lead$feed-userrolefieldid directly into WPUser::setrole without any...

8.8CVSS5.5AI score0.00309EPSS
SaveExploits0References7
CVE
CVE
added 4 days ago12 views

CVE-2026-2916

The Jeg Kit for Elementor WordPress plugin (up to v3.1.1) is vulnerable to Sensitive Information Exposure via enqueue_scripts() in class-dashboard.php. The plugin injects a JkitDashboardOption inline script containing: (1) full plugin inventory (names, versions, paths, active status), (2) system ...

4.3CVSS5.4AI score0.00217EPSS
SaveExploits0References5
NVD
NVD
added 4 days ago8 views

CVE-2026-3141

The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint in all versions up to, and including, 1.9.2 This is due to the REST API route being registered without any...

9.1CVSS0.00467EPSS
SaveExploits0References7
ATTACKERKB
ATTACKERKB
added 4 days ago6 views

CVE-2026-15368

The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on...

5.6AI score0.00136EPSS
SaveExploits0References1
EUVD
EUVD
added 4 days ago10 views

EUVD-2026-51669

An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper...

8.5CVSS6AI score0.00973EPSS
SaveExploits0References4
Cvelist
Cvelist
added 5 days ago39 views

CVE-2026-9044 Command Injection Vulnerability in OpenVPN of TP-Link Archer AXE75

An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper...

8.5CVSS0.00973EPSS
SaveExploits0References3
CVE
CVE
added 5 days ago23 views

CVE-2026-9044

Technical details about CVE-2026-9044 are not publicly available in the provided documents; monitor for updates.

8.5CVSS6AI score0.00973EPSS
SaveExploits0References3
IBM Security Bulletins
IBM Security Bulletins
added 5 days ago5 views

Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the Eclipse Jersey-client library that could cause critical SSL/TLS security configurations issues (CVE-2025-12383).

Summary IBM Storage Protect Server uses the Eclipse Jersey-client library in certain components. A vulnerability in Jersey could cause critical SSL/TLS security configurations issues, which may lead to unauthorized trust of insecure or malicious servers, potentially compromising the confidentiali...

9.4CVSS5.9AI score0.00284EPSS
SaveExploits0Affected Software1
Wolfi
Wolfi
added 5 days ago12 views

GHSA-659M-PX2C-25WJ vulnerabilities

Vulnerabilities for packages: keycloak-config-cli...

5.4AI score
SaveExploits0
EUVD
EUVD
added 5 days ago14 views

EUVD-2026-41139

Jodit has prototype pollution via Jodit.configure / ConfigMerge...

6.3CVSS5.4AI score0.00273EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 5 days ago7 views

CVE-2026-53500

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWEDSOURCES configuration passes plain strings to re.match without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0...

8.2CVSS5.5AI score0.00287EPSS
SaveExploits0References4Affected Software1
NVD
NVD
added 5 days ago8 views

CVE-2026-56567

HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening...

5.1CVSS0.00112EPSS
SaveExploits0References1
NVD
NVD
added 5 days ago10 views

CVE-2026-56569

HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening...

4CVSS0.00112EPSS
SaveExploits0References1
NVD
NVD
added 5 days ago9 views

CVE-2026-52857

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is...

5.5CVSS0.00113EPSS
SaveExploits0References3
Github Security Blog
Github Security Blog
added 5 days ago7 views

Wings exposes node configuration secrets through egg configuration-file templating

Impact Type: Exposure of sensitive information / insufficiently protected credentials leading to privilege escalation and full node compromise. Wings exposes its entire daemon configuration to the egg configuration-file templating engine. When Wings renders a server's configuration files, any...

9.9CVSS5.5AI score0.00274EPSS
SaveExploits0References4Affected Software1
EUVD
EUVD
added 5 days ago10 views

EUVD-2026-51568

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

9.9CVSS5.5AI score0.00274EPSS
SaveExploits0References3
OSV
OSV
added 5 days ago4 views

CVE-2026-52855 Wings exposes node configuration secrets through egg configuration-file templating

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

9.9CVSS5.5AI score
SaveExploits0References5
Cvelist
Cvelist
added 5 days ago35 views

CVE-2026-52855 Wings exposes node configuration secrets through egg configuration-file templating

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

9.9CVSS0.00274EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 5 days ago8 views

CVE-2026-52857

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is...

5.5CVSS5.5AI score0.00113EPSS
SaveExploits0References4Affected Software1
Vulnrichment
Vulnrichment
added 5 days ago8 views

CVE-2026-52857 Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is...

5.5CVSS5.5AI score0.00113EPSS
SaveExploits0References3
Rows per page
Query Builder