280 matches found
CVE-2026-19059 FoundationAgents MetaGPT editor.py read path traversal
A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. This affects the function read of the file metagpt/tools/libs/editor.py. This manipulation causes path traversal. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The vendo...
CVE-2026-65841 Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when conte...
CVE-2026-27436
Editor Arbitrary Code Execution in Five Star Business Profile and Schema = 2.3.19 versions...
EUVD-2026-41338
Editor Arbitrary Code Execution in Five Star Business Profile and Schema = 2.3.19 versions...
CVE-2026-27436
Editor Arbitrary Code Execution in Five Star Business Profile and Schema = 2.3.19 versions...
PT-2026-54982
Editor Arbitrary Code Execution in Five Star Business Profile and Schema = 2.3.19 versions...
CVE-2026-53632 NTLMv2 hash disclosure via UNC path handling on Windows
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the...
The vulnerability of Microsoft Excel spreadsheet editors in Microsoft Office products and Microsoft 365 Apps for Enterprise allows a perpetrator to disclose protected information.
The vulnerability of Microsoft Excel spreadsheet editors within the Microsoft Office and Microsoft 365 Apps for Enterprise software packages is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow attackers to disclose sensitive information that is protecte...
The vulnerability of Microsoft Visual Studio Code’s source editor lies in the incorrect path name limitation for the directory, allowing attackers to bypass existing security restrictions.
The vulnerability of Microsoft Visual Studio Code’s editor is related to incorrect path name restrictions for the directory. Exploiting this vulnerability could allow an attacker to bypass existing security restrictions...
The vulnerability of Microsoft Visual Studio Code’s editor, related to insufficient protection of service data, allows attackers to disclose protected information.
The vulnerability of Microsoft Visual Studio Code’s editor is related to insufficient protection for service data. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...
The vulnerability of Adobe Dreamweaver HTML editor stems from deficiencies in the authentication process, allowing attackers to read arbitrary files.
The vulnerability of the Adobe Dreamweaver HTML editor is related to deficiencies in the authentication process. Exploiting this vulnerability can allow attackers to read arbitrary files...
The vulnerability of Microsoft Visual Studio Code’s editor, related to errors in processing relative path handling for directories, allows attackers to gain read and modify access to data.
The vulnerability of Microsoft Visual Studio Code’s editor is related to errors in handling relative pathnames to directories. Exploiting this vulnerability can allow an attacker to gain read and modify access to data remotely...
The vulnerability of Adobe Dreamweaver HTML editor stems from deficiencies in the authentication process, allowing attackers to execute arbitrary code.
The vulnerability of the Adobe Dreamweaver HTML editor is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker to execute arbitrary code...
CVE-2026-39465
Editor Remote Code Execution RCE in Responsive Slider by MetaSlider = 3.106.0 versions...
WordPress MW WP Form plugin <= 5.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting vulnerability
Authenticated Editor+ Stored Cross-Site Scripting vulnerability discovered by Sérgio Charruadas itzvenom in WordPress Plugin MW WP Form versions = 5.1.3...
EUVD-2024-55605
launch-editor vulnerable to command injection via the crafted request on Windows...
CVE-2026-47742
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Sub-form Livewire components used in the product editor Edit, Inventory, Seo, Shipping, Files had no authorization on their store method. Any authenticated panel user, regardless of role, could mutate any product's pricing, stock, SEO...
RockyLinux 10 : vim (RLSA-2026:19073)
The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:19073 advisory. vim: arbitrary command execution via modeline sandbox bypass CVE-2026-34982 Tenable has extracted the preceding description block directly from the RockyLinux...
PT-2026-44943
Name of the Vulnerable Software and Affected Versions Shopper versions prior to 2.8.0 Description Sub-form Livewire components within the product editor—specifically those handling Edit, Inventory, Seo, Shipping, and Files—lack authorization on their store method. This allows any authenticated...
Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload
In 2025, we observed pervasive SSH tunnel activity, which has remained active into 2026, affecting many government organizations and commercial companies in Russia and Belarus. Behind some of this activity is Cloud Atlas, a group we have known since 2014. During our investigation, we identified n...