383855 matches found
CVE-2026-108614 JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/exportXls
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController exportXls handler that allows any authenticated user to export AI evaluator data. Low-privileged attackers can request /airag/extData/exportXls to download every user's airagextdata evaluator...
CVE-2026-108614
JeecgBoot versions through 3.9.5 are affected by a missing authorization vulnerability in the AiragExtDataController exportXls handler. This flaw allows any authenticated user to access the /airag/extData/exportXls endpoint to export sensitive AI evaluator data , including evaluator definitions a...
CVE-2026-108614 JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/exportXls
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController exportXls handler that allows any authenticated user to export AI evaluator data. Low-privileged attackers can request /airag/extData/exportXls to download every user's airagextdata evaluator...
CVE-2026-41729
CVE-2026-41729: Spring Data REST JSON Patch Map Key SpEL Injection PoC This repository is a minimal reproduction PoC for CVE-2026-41729, as disclosed in the official Spring security advisory. Official advisory: https://spring.io/security/cve-2026-41729/ Official title: Spring Data REST SpEL...
CVE-2025-65482-XXE-
CVE-2025-65482 XXE XML External Entity Injection XXE in XDocReport Bug Definition XML External Entity Injection Vulnerability Overview XML External Entity Injection XXE is a vulnerability in the processing of XML formatted data, where a user injects XML data that references an external file or...
CVE-2025-5287
CVE-2025-5287 Likes and Dislikes Plugin = 1.0.0 - Unauthenticated SQL Injection Description The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied...
CVE-2026-66480
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0...
CVE-2026-62043
Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension = 5.0.7 versions...
CVE-2026-42419
Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup = 1.4.0 versions...
CVE-2026-42630
Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager = 0.2.25 versions...
CVE-2026-98267
A flaw was found in the Linux kernel's 9P file system implementation. When write operations extend a file, the kernel fails to update the recorded file size to reflect the new length. A local user performing write operations on a 9P mount can trigger this issue, leading to inconsistent file state...
CVE-2022-26134
「💥」CVE-2022-26134 Description In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17...
CVE-2026-108604 Tabularis through 0.27.0 Read-Only Bypass via MCP run_query SELECT Classification
Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP runquery safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval,...
CVE-2026-66480
The YITH WooCommerce Product Add-Ons WordPress plugin (versions ≤ 4.34.0 ) is affected by a Sensitive Data Exposure vulnerability (CWE-497). This flaw allows an attacker to retrieve embedded sensitive data from an unauthorized control sphere. While the specific root cause and impacted components ...
EUVD-2026-96425
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0...
CVE-2026-66480 WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Sensitive Data Exposure vulnerability
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0...
CVE-2026-62043
The Contact Form 7 – Dynamic Text Extension plugin for WordPress is affected by an unauthenticated Sensitive Data Exposure vulnerability in versions
EUVD-2026-96473
Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension = 5.0.7 versions...
CVE-2026-62043 WordPress Contact Form 7 – Dynamic Text Extension plugin <= 5.0.7 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension = 5.0.7 versions...