CVE-2026-49864

CVE-2026-49864 (Wetty) is a DOM XSS in the Wetty client (prior to v3.0.4) triggered by a crafted file-download escape sequence that decodes a base64 filename and injects it into a Toastify HTML string without escaping. The attacker-controlled filename can lead to raw HTML/JS rendering in the vict...

CVE-2026-49864 wetty vulnerable to DOM XSS via file-download filename

wetty provides terminal access in browser over http/https. Prior to version 3.0.4, the wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string escapeMarkup: false. Any output the victim renders - a cat'd file, a tailed log,...

CVE-2026-65582

Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...

CVE-2026-61980

Unauthenticated Arbitrary File Download in OMGF Pro = 5.2.7 versions...

EUVD-2026-57980

Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...

CVE-2026-65582

CVE-2026-65582 affects the WordPress AI Hub theme (versions <= 1.3.10). The available documents describe a Subscriber Arbitrary File Download vulnerability in AI Hub

CVE-2026-65582 WordPress AI Hub theme <= 1.3.10 - Arbitrary File Download vulnerability

Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...

CVE-2026-65582

Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...

EUVD-2026-57977

Unauthenticated Arbitrary File Download in OMGF Pro = 5.2.7 versions...

CVE-2026-61980

Unauthenticated Arbitrary File Download in OMGF Pro = 5.2.7 versions...

CVE-2026-61980 WordPress OMGF Pro plugin <= 5.2.7 - Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download in OMGF Pro = 5.2.7 versions...

CVE-2026-61980

CVE-2026-61980 describes an Unauthenticated Arbitrary File Download in OMGF Pro plugin for WordPress, version

WordPress OMGF Pro plugin <= 5.2.7 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by daroo in WordPress Plugin OMGF Pro versions = 5.2.7...

CVE-2026-3835

The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the getadvancefilebyurl method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token looku...

PT-2026-71546

Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...

PT-2026-71543

Unauthenticated Arbitrary File Download in OMGF Pro = 5.2.7 versions...

CVE-2026-47231

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/documents-files.php gates state-changing modes by checking that the actor has hasUploadRight on the URL parameter folderuuid. The movesave handler then operates on a separate URL parameter fileuuid and calls...

CVE-2026-14925

The Import WP WordPress plugin before 2.14.23 has an authorization flaw in one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators. The exploit requires an existing unconsumed export and a low-entropy, time-based download k...

EUVD-2026-57081

The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names an...

CVE-2026-73227 electerm's RDP clipboard file download may parse unsafe file name

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious RDP server to write attacker-controlled content outside the selected save directory because the RDP clipboard download path in...