EUVD-2026-45131

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via the 'family' parameter. This makes it possible for authenticated attackers, with editor-level access and above, to delete...

CVE-2026-15457

Vulnerability summary (CVE-2026-15457) : The Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin is vulnerable to a Directory Traversal in all versions up to and including 6.0.13 via the 'family' parameter . Authenticated attackers with editor-level access or higher can d...

Regular Expression Denial of Service (ReDoS)

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the regexreplace filter and function within the Twig content sandbox when Twig processing in pag...

EUVD-2026-45083

Grav before 2.0.4 contains a regular expression denial of service ReDoS vulnerability in the regexreplace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled security.twigcontent.processenabled: true, disabled by default, an...

CVE-2026-62237 Grav < 2.0.4 ReDoS via regex_replace in Sandbox

Grav before 2.0.4 contains a regular expression denial of service ReDoS vulnerability in the regexreplace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled security.twigcontent.processenabled: true, disabled by default, an...

PT-2026-60711

Name of the Vulnerable Software and Affected Versions Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.0.14 Description The plugin contains a Directory Traversal flaw, which occurs when an application fails to properly sanitize user-supplied input used to construct ...

CVE-2026-15982: Improper Privilege Management

The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.8.4. This is due to due to a missing capability check on the 'aiomaticcallgoogleaifunction' function. This makes ...

ImageMagick Code Execution

The vulnerability of the console-based graphic editor ImageMagick is related to the lack of mechanisms for encoding or shielding the output data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-60976

Name of the Vulnerable Software and Affected Versions joe versions prior to 4.6-4.1 Description An issue allows arbitrary command execution through the use of a malicious tags file. Recommendations Update to version 4.6-4.1...

PT-2026-60647

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.4 Description A regular expression denial of service ReDoS exists in the regex replace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled via the...

ImageMagick Resource Consumption DoS

The vulnerability of the console-based graphic editor ImageMagick is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

magick-distribute-cache DoS

The vulnerability of the magick-distribute-cache service in the console-based imageMagick graphics editor is related to reading data beyond the allowed range of memory. Exploiting this vulnerability could allow an attacker to cause a service failure...

ImageMagick MAT Decoder DoS

The vulnerability of the MAT decoder in the console-based ImageMagick graphics editor is related to reading data outside of the allowed range in memory. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

ImageMagick Use-After-Free

The vulnerability of the console-based graphic editor ImageMagick is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ImageMagick Memory Leak DoS

The vulnerability of the console-based graphic editor ImageMagick is related to the lack of memory release after the effective lifespan of the software. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

SUSE CVE-2026-8595

A user with Editor permissions can craft a dashboard whose table TableNG panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard stored cross-site scripting...

CVE-2026-59865

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, kiota info read x-ms-kiota-info.languagesInformation..dependencyInstallCommand plus dependency name and version values from an OpenAPI description and presented the spec-supplied command as Kiota's recommended insta...

CVE-2026-8595

A flaw in Grafana allows authenticated 'Editor' users to inject malicious scripts into a table panel's field names. Viewing the compromised dashboard executes the script in the victim's browser, risking data theft or client-side attacks...

PT-2026-60397

The Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.3.6. This is due to missing or incorrect nonce validation on the ulpb admin ajax function...

EUVD-2025-210478

LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion LFI in the OnlyOfficeEditor servlet class, allowing authenticated user to exploit path traversal flaws in the fileExt parameter, enabling unauthorized access to sensitive files outside the designated directories...