41685 matches found
CVE-2026-86801
The To Do List Member WordPress plugin (versions 1.4 through 1.6 ) includes a file upload endpoint that fails to load WordPress, meaning no authentication , capability , or nonce checks are enforced. The endpoint validates only the uploaded file's name , not its content , allowing unauthenticated...
EUVD-2026-81384
The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated...
CVE-2026-86801 To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, File Listing and Deletion via Unprotected Upload Handler
The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated...
CVE-2026-86801 To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, File Listing and Deletion via Unprotected Upload Handler
The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated...
CVE-2026-86801: Missing Authentication for Critical Function
The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated...
CVE-2026-54649: Exposure of Sensitive Information to an Unauthorized Actor
punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward, which silently drops the added Reply-To header intended to route responses through the relay. When ...
CVE-2026-45140: Improper Limitation of a Pathname to a Restricted Directory
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is...
Linux Distros Unpatched Vulnerability : CVE-2026-79994
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the...
EulerOS 2.0 SP15 : python-idna (EulerOS-SA-2026-3791)
According to the versions of the python-idna package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and...
CVE-2026-68523: Uncontrolled Resource Consumption
fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19.0, a body-direct child whose CSS-resolved height greatly exceeds the page height was sliced into one fragment per page with no upper bound. This is fixed in...
CVE-2026-71180
Dell Update Package Framework, versions prior to 26.07.03, contains an Unchecked Return Value vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges...
CVE-2026-75029 Message parser retains every identical singleton RDATA, enabling wire-to-work amplification
In a query response, an attacker may send named multiple copies of a record that should only exist once such as an SOA record. If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly...
CVE-2026-75029
CVE-2026-75029 affects ISC BIND 9 (versions 9.11.0–9.18.50, 9.20.0–9.20.27, 9.21.0–9.21.25, and corresponding -S1 releases). The message parser fails to deduplicate singleton records (e.g., SOA) in a query response: when an attacker sends multiple copies with identical RDATA, each copy is appende...
EUVD-2026-80052
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE component: Compiler. The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1; Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows...
CVE-2026-92213 a2ui-project a2ui Angular Renderer server-to-client.ts z.any injection
A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/webcore/src/v09/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible t...
CVE-2026-92213: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/webcore/src/v09/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible t...
CVE-2026-92137: Improper Limitation of a Pathname to a Restricted Directory
Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is contained within the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to create or replace arbitrary files on the...
CVE-2026-92599: Inefficient Regular Expression Complexity
joi npm package joi, hapi.js versions =17.2.0 =18.0.0 18.2.6 are vulnerable to regular expression denial of service in the Joi.string.isoDate validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-secon...
CVE-2026-59944: Improper Limitation of a Pathname to a Restricted Directory
Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer validates literal parent-directory segments only during dependency resolutio...
