22942 matches found
CVE-2026-39441 WordPress Feed KuantoKusta for WooCommerce – Free plugin <= 5.3 - SQL Injection vulnerability
Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free = 5.3 versions...
CVE-2025-68851
CVE-2025-68851 refers to the WordPress Okay Toolkit plugin (<= 2.3) and describes an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability. The vulnerability was identified by Skalucy. The provided documents do not specify the exact vulnerable input, affected product version(s) be...
CVE-2025-68049
CVE-2025-68049 affects the WordPress bunny.net plugin, version up to 2.3.6, with a Broken Access Control flaw. The CVSS 3.1 base metrics indicate Low impact to confidentiality, integrity, and availability, and a network attack vector with low privileges required and no user interaction. The provi...
EUVD-2026-37002
Cursor is a code editor built for programming with AI. In versions prior to 3.0.0, the Cursor Desktop could execute workspace-defined Claude hook commands from .claude/settings.local.json without dedicated user approval. A malicious workspace or agent-created file could configure hooks that run...
GHSA-W7VC-732C-9M39
creationtimestamp| type| source ---|---|--- 2026-06-15 19:41:20+00:00| seen| https://gist.github.com/alon710/65e78fc78054322fc9a9e7b7f341ade1 2026-06-15 19:51:29+00:00| seen| https://gist.github.com/alon710/9d5d358571e9a39984e3ba8848038e82 2026-06-15 20:01:21+00:00| seen|...
CVE-2026-48114 Metacat has an unauthenticated SQL injection vulnerability
Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.0.0 and and above contain an unauthenticated SQL injection in the /harvesterRegistration endpoint. HarvesterRegistration.dbInsert builds an INSERT against HARVESTSITESCHEDULE via string...
GHSA-FX2H-PF6J-XCFF vite: `server.fs.deny` bypass on Windows alternate paths
Summary The contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev server to the network using --host or server.host config option - the sensitive file...
vite: `server.fs.deny` bypass on Windows alternate paths
Summary The contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev server to the network using --host or server.host config option - the sensitive file...
CVE-2026-52704
creationtimestamp| type| source ---|---|--- 2026-06-15 15:00:13+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3modkepmag52l 2026-06-15 15:00:19+00:00| seen| https://infosec.exchange/users/offseq/statuses/116754717813611535 2026-06-15 15:56:20+00:00| seen|...
SUSE-SU-2026:2397-1 Security update for openssl-3
This update for openssl-3 fixes the following issues - CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion bsc1266340. - CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption bsc1266341. - CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing...
CVE-2026-5038 multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads
Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the Readable.pipe call does not propagate the stream destroy signal to the...
sql_injection_exploit.sh
sqlinjectionexpl...
CVE-2026-12217
creationtimestamp| type| source ---|---|--- 2026-06-15 04:30:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/116752241414863988 2026-06-15 04:30:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3moch6lbnsc2i 2026-06-15 05:00:05+00:00| seen|...
EUVD-2026-36677
A vulnerability has been found in Intelliants Subrion CMS up to 4.0.3. Affected by this issue is some unknown functionality of the component Blocks Endpoint. Such manipulation of the argument CSS class name leads to cross site scripting. The attack may be launched remotely. The exploit has been...
CVE-2026-12193
creationtimestamp| type| source ---|---|--- 2026-06-15 00:00:36+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3moby42wvt52y 2026-06-15 00:00:38+00:00| seen| https://infosec.exchange/users/offseq/statuses/116751180370821217 2026-06-15 01:00:26+00:00| seen|...
ROS-20260615-73-0042
The vulnerability of the persistentcachereadentryv3 function in the RDP client FreeRDP is related to buffer overflow in dynamic memory. Exploiting this vulnerability could allow an attacker to compromise the integrity and accessibility of protected information...
python311-tornado6-6.5.7-1.1 on GA media (moderate)
python311-tornado6-6.5.7-1.1 on GA media Announcement ID: openSUSE-SU-2026:11027-1 Rating: moderate Cross-References: CVE-2026-49853 CVE-2026-49854 CVE-2026-49855 Affected Products: openSUSE Tumbleweed An update that solves 3 vulnerabilities can now be installed. Description: These are all securi...
PT-2026-49510
Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce = 3.1.4 versions...