35387 matches found
CVE-2026-71270 Stirling-PDF Server-Side Request Forgery via /api/v1/convert/url/pdf WeasyPrint Subprocess
Stirling-PDF's POST /api/v1/convert/url/pdf endpoint ConvertWebsiteToPDF.java was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints html/pdf, file/pdf, markdown/pdf...
Malicious code in @rentwise/common (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e2ac6bf5ebc05e3dcf6a84122d0b10d5d5f36c5b4cec9f8d0b305d1b8125f47 build/index.js appends an evalatob... blob to the legitimate common-library exports, so the payload runs whenever any consumer requires...
CVE-2026-71236 Grocy - Stored XSS via HTMLPurifier Output Double-Decode
Grocy's API request-body parser controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing , , and back to , and & immediately after purification...
CVE-2026-71235 Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine
Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine re/lua.go performs no input validation at all and preloads dangerous libraries: db arbitrary database access, ioutil file I/O, ...
CVE-2026-71235
CVE-2026-71235 affects Magistrala’s Rules Engine, where authenticated users can create rules with embedded Go or Lua scripts that execute server-side when IoT messages arrive. The Go engine (re/golang.go) runs scripts via Yaegi, exposing the full Go standard library (including os and net/http) wi...
CVE-2026-7726
The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the LayoutsWPBRemote::templatesync callback registered via wpajaxnoprivhandlesync in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated...
CVE-2026-71208
KubeSphere's cluster-controller reconciliation pkg/utils/clusterclient/clusterclient.go, addCluster processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL synt...
CVE-2026-5651
The Askeet plugin for WordPress is vulnerable to SQL Injection via the 'sqlquery' parameter in multiple AJAX actions askeetexecutesqlquery, askeetexportallresults in all versions up to, and including, 3.0. This is due to the askeetissafequery filter being bypassable using MySQL conditional commen...
CVE-2026-59675
CVE-2026-59675 affects Rancher Manager when API audit logging is enabled. The audit middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because it is positioned earlier than Rancher’s APIBodyLimitingHandler, the default 1 MiB body cap is by...
CVE-2026-55996 Unauthenticated Denial-of-Service via TLS SAN Stuffing in Rancher and cattle-cluster-agent
A denial-of-service vulnerability was identified in multiple TLS listeners in Rancher. Both the cattle-cluster-agent component running in downstream clusters and the Rancher server itself use the dynamiclistener library to serve TLS traffic. Without an effective CN filter configured,...
CVE-2026-15210
The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeri...
CVE-2026-71210 mealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata Access
Mealie's AsyncSafeTransport SSRF guard mealie/pkgs/safehttp/transport.py resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independentl...
EUVD-2026-53205
KubeSphere's cluster-controller reconciliation pkg/utils/clusterclient/clusterclient.go, addCluster processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL synt...
CVE-2026-71208 KubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation
KubeSphere's cluster-controller reconciliation pkg/utils/clusterclient/clusterclient.go, addCluster processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL synt...
CVE-2026-71208 KubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation
KubeSphere's cluster-controller reconciliation pkg/utils/clusterclient/clusterclient.go, addCluster processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL synt...
CVE-2026-71208 KubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation
KubeSphere's cluster-controller reconciliation pkg/utils/clusterclient/clusterclient.go, addCluster processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL synt...
EUVD-2026-53201
changedetection.io's /settings save handler builds an update dict from form.data'application' and blind-merges it into the stored application settings via .update. Because WTForms represents an unchecked checkbox as False rather than 'unchanged', and only the 'password' field is special-cased...
CVE-2026-71204 changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement
changedetection.io's /settings save handler builds an update dict from form.data'application' and blind-merges it into the stored application settings via .update...
CVE-2026-7444 Search Analytics for WP <= 1.4.16 - Cross-Site Request Forgery
The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the processbulkaction function of MWTSAStatsTable. This makes it possible for unauthenticated attacker...