CVE-2026-76012: smub: The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code…

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the legacyrender function. This is due to broken authorization on the Lightroom galleryedit endpoint combined with mass...

CVE-2026-119336: pi-hole: Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory...

CVE-2026-119334: pi-hole: Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, gravity.sh checks file:// adlist readability with sudo -u pihole test -r but then allows curl, sometimes running as root, to normalize URL dot segments and open a...

CVE-2026-119343: Stirling-Tools Stirling-PDF: Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attacker-controlled htmlContent and passes it to WeasyPrint without CustomHtmlSanitizer, unlike the sanitized...

CVE-2026-61586: copernik-eu copernik-xml-factory: Copernik XML Factory provides secure-by-default JAXP factory creation for Java

Copernik XML Factory provides secure-by-default JAXP factory creation for Java. Prior to 0.1.2, Copernik XML Factory does not block XInclude resource resolution on the stock JDK provider after an application enables XInclude on a factory returned by XmlFactories.newDocumentBuilderFactory or...

CVE-2026-62863: gojue moling: MoLing is a computer-use and browser-use based MCP server

MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using -l, its /sse and /message HTTP endpoints do not authenticate requests and the mcp-go dependency sets Access-Control-Allow-Origin: . A malicious web page can open a cross-origin EventSourc...

CVE-2026-62121: Unlimited Elements: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability…

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows PHP Local File Inclusion.This issue affects Unlimited...

PT-2026-133453

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod sftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are...

CVE-2026-62965: sabnzbd: SABnzbd is an open source automated Usenet download tool

SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in sabnzbd/api.py accepts the user-controlled value parameter without path confinement before os.path.join with downloaddir. An absolute path discards that base directory. An attacker with a valid...

CVE-2026-119842: Red Hat: A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser

A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when a user opens or plays media with a malformed MicroDVD .sub subtitle file...

Medium: awscli

Issue Overview: Overly permissive file permissions in AWS CLI before 1.44.78 v1 and 2.34.29 v2 on Unix-like systems where the umask has not been configured to restrict file permissions the default on most systems may allow other local users on the same host to read credentials written by certain...

CVE-2026-119117: AWS amazon-kinesis-producer: Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the…

Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versio...

Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357...

CVE-2026-119210

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the ClientMessage.validateLocalFileName check used a regular expression that could match LOAD DATA LOCAL INFILE text inside quoted identifiers, string...

VulnCheck KEV: CVE-2025-11201

MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability. The specific flaw...

VulnCheck KEV: CVE-2010-20125

DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to requireonce. Attackers can supply path traversal sequences ../../ to include...

SonLogger-vulns

CVE-2021-27964 | SonLogger - Unauthenticated Arbitrary File Upload Metasploit Date: 30-01-2021 Exploit Author: Berkan Er [email protected] Vendor Homepage: https://www.sonlogger.com/ Software Link: https://www.sonlogger.com/download Version: 4.2.3.3 Tested on: Windows 10 Enterprise x64 CVE:...

CVE-2022-21970

CVE-2022-21970 Description Microsoft Edge Chromium-based Elevation of Privilege Vulnerability. This vulnerability allows an attacker to execute javascript code on every host without permission, also an attacker can steal local system files, and also he can manipulate the actions against the machi...

CVE-2017-0199

Exploit toolkit CVE-2017-0199 - v2.0 Exploit toolkit CVE-2017-0199 - v2.0 is a handy python script which provides a quick and effective way to exploit Microsoft RTF RCE. It could generate a malicious RTF file and deliver metasploit / meterpreter payload to victim without any complex configuration...

CVE-2026-59774_docker

CVE-2026-59774docker 1. Pull gitea git clone https://github.com/FlowerWitch/CVE-2026-59774docker cd ./CVE-2026-59774docker docker compose up -d 2. Initialization Access gitea http://localhost:3000/install 3. Create repository new repository defaults to public, no other configuration needed 4...