3450 matches found
CVE-2026-42458
CVE-2026-42458 (Magento LTS/OpenMage Magento-LTS) : A reflected XSS in the admin-import/export Dataflow - Profiles feature allows injection via the filename parameter in the Dataflow Import path. Affected: OpenMage/magento-lts (unofficial Magento LTS) prior to version 20.18.0. Evidence across sou...
CVE-2026-42458 Magento LTS: Reflected XSS - Import -> Data Flow (profiles)
Magento Long Term Support LTS is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, there is a reflected XSS vulnerability under admin panel - System - Import/Export -...
CVE-2026-42458: Improper Neutralization of Alternate XSS Syntax
Magento Long Term Support LTS is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, there is a reflected XSS vulnerability under admin panel - System - Import/Export -...
Malicious code in cheerio-tool (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d51a2885f4eaff732d1ef7ab065b04d21c59263b1212d5b92b92c87914ef879 cheerio-tool typosquats the popular cheerio HTML parser README claims 'Cheerio Tool utility helpers', keywords are 'lodash','utilities', and index.js...
dbt MCP Server has an Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters
Discovered through manual source code review. Verified by PoC execution against a local dbt-mcp v1.15.1 installation. Summary rundbtcommand in src/dbtmcp/dbtcli/tools.py constructs the dbt subprocess argument list by appending user-supplied MCP tool parameters without sanitization. Two independen...
GHSA-XPWW-F6PM-CFHQ dbt MCP Server has an Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters
Discovered through manual source code review. Verified by PoC execution against a local dbt-mcp v1.15.1 installation. Summary rundbtcommand in src/dbtmcp/dbtcli/tools.py constructs the dbt subprocess argument list by appending user-supplied MCP tool parameters without sanitization. Two independen...
CVE-2026-8328
creationtimestamp| type| source ---|---|--- 2026-05-14 00:03:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlrjejlkhq2i 2026-05-14 01:19:43+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mlrnl5s34g22 2026-05-17 15:04:58+00:00| seen|...
CVE-2026-40629
When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
CVE-2026-42920
CVE-2026-42920 affects BIG-IP DTLS: when a Client SSL profile has Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate, resulting in a DoS as TMM restarts. The F5 advisory notes this is a data-plane issue with rem...
CVE-2026-40629
CVE-2026-40629 affects BIG-IP SSL/TLS when SSL profiles are configured on a virtual server. The issue can cause the virtual server to stop processing new client connections, effectively a DoS for new connections. The F5 advisory confirms this is a data plane issue; no control plane exposure. Miti...
WordPress ProfileGrid – User Profiles, Groups and Communities plugin <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection vulnerability
Authenticated Subscriber+ SQL Injection vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin ProfileGrid versions = 5.9.8.4...
CVE-2026-42288
creationtimestamp| type| source ---|---|--- 2026-05-13 01:30:33+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mlp5qjkhja2g 2026-05-13 01:30:36+00:00| seen| https://infosec.exchange/users/offseq/statuses/116564677807182613 2026-05-13 01:31:22+00:00| seen|...
CVE-2026-4607: Missing Authorization
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action via the pmsetgrouporder, pmsetgroupitem...
CVE-2026-4608: Improper Neutralization of Special Elements used in an SQL Command
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind SQL Injection via the 'rid' parameter in all versions up to, and including, 5.9.8.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQ...
CVE-2026-4609: Missing Authorization
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the pminviteuser function in all versions up to, and including, 5.9.8.4. This makes it possible for authenticated attackers, with Subscriber-level...
PT-2026-40651
Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions prior to 17.1.3.1 F5 BIG-IP versions prior to 17.5.1.4 BIG-IP Next SPK affected versions not specified BIG-IP Next CNF affected versions not specified BIG-IP Next for Kubernetes affected versions not specified Description Wh...
CVE-2026-40629: Allocation of Resources Without Limits or Throttling
When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
CVE-2026-42864
creationtimestamp| type| source ---|---|--- 2026-05-11 20:02:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlm2wl32sv2z 2026-05-11 20:02:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlm2wl32sv2z 2026-05-11 20:35:42+00:00| seen|...
CVE-2026-45223
creationtimestamp| type| source ---|---|--- 2026-05-11 20:02:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlm2wduquj2k 2026-05-11 20:30:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlm4jgz6l62e 2026-09-12 10:00:07+00:00| seen|...
EUVD-2026-29116
HireFlow v1.2 is vulnerable to Incorrect Access Control. The application does not enforce object-level authorization on the /candidate/ and /interview/ endpoints. The route handlers retrieve records by the user-supplied ID without verifying that the requesting user is the owner or has an authoriz...