8641 matches found
CVE-2026-93000
The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform SQL injection attacks...
CVE-2026-93000 SPS-Suite <= 1.4.0 - Unauthenticated Time-Based SQLi via Search
The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform SQL injection attacks...
EUVD-2026-88095
The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform SQL injection attacks...
CVE-2026-93000
The SPS-Suite WordPress plugin (versions
CVE-2026-93000: Improper Neutralization of Special Elements used in an SQL Command
The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform SQL injection attacks...
PT-2026-99780
Name of the Vulnerable Software and Affected Versions SPS-Suite WordPress plugin versions prior to 1.4.1 Description An issue exists when the static-page search feature is enabled, where the plugin fails to sanitize the search query before incorporating it into a SQL query. This allows...
PT-2026-102392
Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.38.4 Description A static buffer overflow exists in the RemoteCameraHttp::GetResponse function. This issue allows malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers by sending oversiz...
Trajectory-Level Security Debt in LLM Coding Agents
LLM coding agents can traverse hundreds of intermediate code states before submitting a solution. Evaluating only the final artifact leaves the evolution of security findings unmeasured. We introduce the Security Debt Line Integral SDLI, which accumulates static-analysis risk when an agent reache...
wbx
wbx A white-box web application security testing tool. Point...
Linux Distros Unpatched Vulnerability : CVE-2026-100694
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw...
DEBIAN-CVE-2026-100694
Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting XSS in the generated site...
CVE-2026-100692
Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ or a vendored module could contain a symlink at a mount root for example themes/mytheme/assets -...
DEBIAN-CVE-2026-100692
Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ or a vendored module could contain a symlink at a mount root for example themes/mytheme/assets -...
CVE-2026-100692
Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ or a vendored module could contain a symlink at a mount root for example themes/mytheme/assets -...
CVE-2026-100694
Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting XSS in the generated site...
CVE-2026-100694 Hugo before 0.166.0 Cross-Site Scripting via text/org
Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting XSS in the generated site...
CVE-2026-100692 Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots
Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ or a vendored module could contain a symlink at a mount root for example themes/mytheme/assets -...
CVE-2026-100692
Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ or a vendored module could contain a symlink at a mount root for example themes/mytheme/assets -...
CVE-2026-100692
Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ or a vendored module could contain a symlink at a mount root for example themes/mytheme/assets -...
EUVD-2026-87665
Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ or a vendored module could contain a symlink at a mount root for example themes/mytheme/assets -...