WordPress TS Poll < 2.4.0 - SQL Injection

WordPress TS Poll plugin 2.4.0 contains a SQL injection caused by lack of sanitization and escaping of a parameter before using it in a SQL statement, letting attackers perform SQL injection attacks, exploit requires admin privileges. id: CVE-2024-8625 info: name: WordPress TS Poll 2.4.0 - SQL...

CVE-2026-19478

CVE-2026-19478 GitLab GraphQL unauthenticated project deletion ★ CVE-2026-19478 GitLab GraphQL @glintroduced unauthenticated arbitrary-method-invocation PoC ★ https://github.com/user-attachments/assets/bb5d5f8a-a9bf-4148-854b-14c25c501d4b Overview CVE-2026-19478 is an unauthenticated...

CVE-2026-7028-SQLI

CodeAstro-Online-Job-Portal-SQLi-Delete-All Details Vendor: CodeAstro Product: Online Job Portal Project in PHP MySQL Version: 1.0 Vulnerability Type: SQL Injection CWE: CWE-89 Affected Endpoint: /admin/jobs-admins/delete-jobs.php Parameter: id GET Impact: Allows deletion of all job records in th...

Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories

Summary @quasar/app-vite recursively removes build.distDir before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory...

EUVD-2026-93573

Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories...

GHSA-Q9MQ-245R-4G93 Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories

Summary @quasar/app-vite recursively removes build.distDir before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory...

CVE-2026-102781

Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider 5.4.6 - modOsTouchSliderHelper::getAjax, wired through Joomla’s core comajax dispatcher, is the single handler behind every data-management operation this module exposes. No call to JFactory::getUser,...

CVE-2026-102781

The OrdaSoft Touch Slider Joomla extension versions prior to 5.4.6 is vulnerable to unauthenticated destructive CRUD operations. The root cause is a lack of access control, authentication checks (missing JFactory::getUser()), and CSRF token verification within the modOsTouchSliderHelper::getAjax(...

PT-2026-107424

Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider 5.4.6 - modOsTouchSliderHelper::getAjax, wired through Joomla’s core com ajax dispatcher, is the single handler behind every data-management operation this module exposes. No call to JFactory::getUser,...

CVE-2026-87975

A flaw was found in Django. When handling model formsets where primary keys can be modified through form fields, the application does not properly validate submitted key values against the authorized query scope. A remote attacker with permission to submit form data can exploit this issue by...

CVE-2026-106109

The Quasar Framework 's @quasar/app-vite component (versions 1.0.0 through 3.3.0) contains a vulnerability where it recursively removes the build.distDir before building. The root cause is a lack of validation to reject sensitive paths such as the project root, user home directory, filesystem roo...

CVE-2026-106109 Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external...

DEBIAN-CVE-2026-87975

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.forms.models.BaseModelFormSet.saveexistingobjects used the presence of a primary key on a submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An...

CVE-2026-106037 Mooncake through 0.3.13.post1 Missing Authentication in Store REST Service

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unauthenticated attackers can call routes such as /api/get, /api/put, /api/removeall and /api/mount to read cached KV data with user...

EUVD-2026-93396

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.forms.models.BaseModelFormSet.saveexistingobjects used the presence of a primary key on a submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An...

CVE-2026-87975 Privilege abuse in model formsets with editable primary keys

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.forms.models.BaseModelFormSet.saveexistingobjects used the presence of a primary key on a submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An...

org.hibernate/hibernate-core: Hibernate: Information disclosure and data deletion via second-order SQL injection

A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive informatio...

org.hibernate/hibernate-core: Hibernate: Information disclosure and data deletion via second-order SQL injection

A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive informatio...

org.hibernate/hibernate-core: Hibernate: Information disclosure and data deletion via second-order SQL injection

A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive informatio...

PT-2026-106826

Name of the Vulnerable Software and Affected Versions Quasar Framework versions 1.0.0 through 3.2.9 Description The @quasar/app-vite component recursively removes the resolved build.distDir before the build process begins. It fails to reject the project root, user home directory, filesystem roots...