25389 matches found
CVE-2026-15452: Improper Neutralization of Input During Web Page Generation
The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query String in all versions up to, and including, 6.11.3 due to insufficient input sanitization and output escaping. This makes it possible for...
PT-2026-68345
Name of the Vulnerable Software and Affected Versions HDF5 versions prior to 2.3.0 Description An untrusted pointer dereference exists in the render bin output function of the h5dump tool. This occurs when a variable-length string dataset containing more than one element is dumped in binary mode...
sql-string.js ORM Escape SQL Injection
The vulnerability of the escape function in the sql-string.js ORM library by Sequelize is related to the lack of security measures taken to protect the SQL query structure when processing TODATE and TOTIMESTAMP parameters. Exploiting this vulnerability could allow an attacker to execute arbitrary...
CVE-2026-45100
OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the s.b64encode string transformation. The size check for s.b64encode only verifies that the input fits within the 64 KB transformation buffer, but...
CVE-2026-70553
MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install endpoint after installation is complete. Attackers can supply a malicious...
EUVD-2026-52913
MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install endpoint after installation is complete. Attackers can supply a malicious...
sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export
A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...
GHSA-RWRP-9823-P2XQ Flowise: Incomplete Credential Redaction Exposes Secrets via API
Summary The GET /api/v1/credentials/:id endpoint decrypts stored credential data and returns it in the plainDataObj field of the API response. While a redactCredentialWithPasswordType function masks fields defined with type: 'password' in their component schema, many credential types store highly...
CVE-2026-48121 @langchain/langgraph-checkpoint-mongodb: NoSQL parameter injection in MongoDBSaver allows cross-tenant state access
@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers threadid, checkpointns, checkpointid from config.configurable are passed into MongoDB fi...
org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing
A flaw was found in Eclipse Jetty. The HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used. An attacker can inject crafted requests to manipulate and trick the parser. This issue can lead to security controls bypass, cache poisoning or unauthorized endpoint access...
EUVD-2026-52747
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...
CLSA-2026-1784769609 TuxCare security update for qs (3 CVEs)
TuxCare rebuilt qs to address 3 CVEs. Fixed in 6.7.0-tuxcare.2...
CLSA-2026-1775003174 TuxCare security update for underscore.string (1 CVE)
TuxCare rebuilt underscore.string to address 1 CVE. Fixed in 2.3.3-tuxcare.1...
CLSA-2026-1775003175 TuxCare security update for underscore.string (1 CVE)
TuxCare rebuilt underscore.string to address 1 CVE. Fixed in 2.2.1-tuxcare.1...
CLSA-2026-1774570927 TuxCare security update for color-string (1 CVE)
TuxCare rebuilt color-string to address 1 CVE. Fixed in 0.3.0-tuxcare.1...
Malicious code in keyv (npm)
npm/keyv version 6.0.0 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub Action...
sg3_utils security, bug fix, and enhancement update
1.48-7.1 - sginq output conformance for SCSI name string and ATA fields RHEL-188123...
sg3_utils security, bug fix, and enhancement update
1.47-10.1 - sginq output conformance for SCSI name string and ATA fields RHEL-188130...
PT-2026-67732
Name of the Vulnerable Software and Affected Versions OpenMeter versions v1.0.0-beta.218 through v1.0.0-beta.231 Description Stored, or second-order, SQL injection occurs during the handling of customer usage-attribution values. An attacker with permissions to create or update a customer can stor...