CVE-2026-120513

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the removecsvfileafteremailsend function in all versions up to, and including, 3.6.2 This makes it possible fo...

CVE-2026-120513

The Everest Forms WordPress plugin (versions up to and including 3.6.2 ) is vulnerable to unauthenticated arbitrary file deletion due to insufficient file path validation in the remove_csv_file_after_email_send function. Attackers can delete files within the wp-content/uploads directory, potentia...

EUVD-2026-120824

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the removecsvfileafteremailsend function in all versions up to, and including, 3.6.2 This makes it possible fo...

CVE-2026-120513 Everest Forms <= 3.6.2 - Unauthenticated Arbitrary File Deletion via 'everest_forms_{form_id}_old_{field_id}' Parameter

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the removecsvfileafteremailsend function in all versions up to, and including, 3.6.2 This makes it possible fo...

CVE-2026-120513: wpeverest: The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is…

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the removecsvfileafteremailsend function in all versions up to, and including, 3.6.2 This makes it possible fo...

WordPress Plugin: everest-forms: CVE-2026-120513: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the removecsvfileafteremailsend function in all versions up to, and including, 3.6.2 This makes it possible fo...

PT-2026-141545

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the remove csv file after email send function in all versions up to, and including, 3.6.2 This makes it possib...

CVE-2026-109560

A flaw was found in Continue CLI. A remote attacker can exploit a permission bypass vulnerability by injecting instructions into repository files or fetched web pages that cause the application to chain unauthorized commands after permitted command prefixes. A successful attack can result in...

CVE-2026-116109

A flaw was found in Continue. This vulnerability allows arbitrary command execution due to an operating system OS command injection flaw in the Model Context Protocol MCP Server Transport component. A remote attacker could exploit this issue by supplying manipulated connection parameters to the...

CVE-2026-116109

A vulnerability has been found in continuedev Continue 2.0.0. This vulnerability affects the function MCPManagerSingleton.setConnections of the file core/config/ConfigHandler.ts of the component MCP Server Transport. Such manipulation leads to os command injection. The attack can be executed...

CVE-2026-116109

A vulnerability exists in continuedev Continue 2.0.0 within the MCP Server Transport component. Specifically, the MCPManagerSingleton.setConnections function in the file core/config/ConfigHandler.ts is susceptible to OS command injection . This flaw can be exploited remotely to execute arbitrary ...

EUVD-2026-109601

A vulnerability has been found in continuedev Continue 2.0.0. This vulnerability affects the function MCPManagerSingleton.setConnections of the file core/config/ConfigHandler.ts of the component MCP Server Transport. Such manipulation leads to os command injection. The attack can be executed...

CVE-2026-116109 continuedev Continue MCP Server Transport ConfigHandler.ts MCPManagerSingleton.setConnections os command injection

A vulnerability has been found in continuedev Continue 2.0.0. This vulnerability affects the function MCPManagerSingleton.setConnections of the file core/config/ConfigHandler.ts of the component MCP Server Transport. Such manipulation leads to os command injection. The attack can be executed...

CVE-2026-116109 continuedev Continue MCP Server Transport ConfigHandler.ts MCPManagerSingleton.setConnections os command injection

A vulnerability has been found in continuedev Continue 2.0.0. This vulnerability affects the function MCPManagerSingleton.setConnections of the file core/config/ConfigHandler.ts of the component MCP Server Transport. Such manipulation leads to os command injection. The attack can be executed...

PT-2026-123155

A vulnerability has been found in continuedev Continue 2.0.0. This vulnerability affects the function MCPManagerSingleton.setConnections of the file core/config/ConfigHandler.ts of the component MCP Server Transport. Such manipulation leads to os command injection. The attack can be executed...

HTTP Response Splitting

io.netty:netty-codec-http is vulnerable to HTTP response splitting. The vulnerability is due to incorrect pairing of outbound responses with inbound requests when processing 100 Continue informational responses, which allows an attacker to exploit pipelined HTTP/1.1 GET and HEAD requests with...

Linux Distros Unpatched Vulnerability : CVE-2025-55702

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the...

CVE-2025-55702

When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smugg...

DEBIAN-CVE-2025-55702

When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smugg...

CVE-2025-31699

Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body dat...