494743 matches found
GO-2026-6374 SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB in github.com/siyuan-note/siyuan/kernel
SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent publish mode: reader-reachable raw SQL method 2 and unescaped REGEXP method 3 on read-write asset-content DB in github.com/siyuan-note/siyuan/kernel...
GO-2026-6410 SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel in github.com/siyuan-note/siyuan/kernel
SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column queryBlocks: malicious imported package executes SQL on victim kernel in github.com/siyuan-note/siyuan/kernel...
GO-2026-6435 Semaphore U: OS Command Injection in github.com/semaphoreui/semaphore
Semaphore U: OS Command Injection in github.com/semaphoreui/semaphore...
GO-2026-6357 OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods in github.com/openchoreo/openchoreo
OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods in github.com/openchoreo/openchoreo...
GO-2026-6402 SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle in github.com/siyuan-note/siyuan/kernel
SiYuan: SQL injection in backlink/mention search via unescaped stored and client input publish mode: first-order client keyword and second-order stored document title breakout on read-write handle in github.com/siyuan-note/siyuan/kernel...
EUVD-2026-75543
AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to publish content into other tenants' namespaces. Attackers can write published views with attacker-controlled title, body and metadata int...
CVE-2026-88898 AppFlowy-Cloud 0.7.2 through 0.9.64 Missing Workspace Authorization on Bulk Publish Endpoint
AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to publish content into other tenants' namespaces. Attackers can write published views with attacker-controlled title, body and metadata int...
CVE-2026-88898 AppFlowy-Cloud 0.7.2 through 0.9.64 Missing Workspace Authorization on Bulk Publish Endpoint
AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to publish content into other tenants' namespaces. Attackers can write published views with attacker-controlled title, body and metadata int...
CVE-2026-84819 WordPress WPAdverts plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WPAdverts = 2.3.3 versions...
CVE-2026-81800 WordPress Verified Reviews (Avis Vérifiés) plugin <= 2.4.6 - SQL Injection vulnerability
Unauthenticated SQL Injection in Verified Reviews Avis Vérifiés = 2.4.6 versions...
CVE-2026-81800
CVE-2026-81800 affects the WordPress plugin Verified Reviews (Avis Vérifiés) in versions ≤ 2.4.6 , where an unauthenticated SQL injection vulnerability is present. The flaw allows a remote attacker with no prior access to execute crafted SQL queries, resulting in a high confidentiality impact and...
CVE-2026-81800 WordPress Verified Reviews (Avis Vérifiés) plugin <= 2.4.6 - SQL Injection vulnerability
Unauthenticated SQL Injection in Verified Reviews Avis Vérifiés = 2.4.6 versions...
EUVD-2026-75529
Unauthenticated SQL Injection in Verified Reviews Avis Vérifiés = 2.4.6 versions...
CVE-2026-81784
An unauthenticated PHP Object Injection vulnerability affects the WordPress Wise Chat plugin in versions ≤ 3.4 , as discovered by Peng Zhou . The flaw allows a remote attacker with no prior access or user interaction to inject a crafted serialized object, leading to high impact on confidentiality...
EUVD-2026-75517
Unauthenticated PHP Object Injection in Wise Chat = 3.4 versions...
CVE-2026-81784 WordPress Wise Chat plugin <= 3.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Wise Chat = 3.4 versions...
CVE-2026-81784 WordPress Wise Chat plugin <= 3.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Wise Chat = 3.4 versions...
EUVD-2026-75511
Unauthenticated Content Injection in Simple Cloudflare Turnstile = 1.42.1 versions...