44477 matches found
CVE-2026-32966 Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure
DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue...
CVE-2026-32966
The CVE affects Apache DolphinScheduler prior to 3.4.2. A missing authorization check in the DataSource API allows exposure of arbitrary data source metadata to unauthenticated users, enabling potential disclosure of sensitive information. The issue’s root cause is insufficient access control on ...
WordPress Motors plugin <= 1.4.109 - SQL Injection vulnerability
SQL Injection vulnerability discovered by endy in WordPress Plugin Motors versions = 1.4.109...
PT-2026-50345
Unauthenticated PHP Object Injection in JetEngine = 3.8.10 versions...
CVE-2026-48822: Improper Neutralization of Input During Web Page Generation
Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a stored Cross-Site Scripting XSS vulnerability in the Markdown-to-HTML conversion process used in the Bookmark Description field. An authenticated user can inject a malicious javascript: URI inside a Markdown link. The...
PT-2026-50421
Improper Control of Generation of Code 'Code Injection' vulnerability in Monetizemore Advanced Ads allows Remote Code Inclusion. This issue affects Advanced Ads: from n/a through 2.0.21...
CVE-2026-46939: Undefined Security Weakness
Vulnerability in the Oracle Configure to Order product of Oracle E-Business Suite component: Supply to Order Workbench. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...
CVE-2025-60223: Improper Limitation of a Pathname to a Restricted Directory
Subscriber Arbitrary File Deletion in WPBot Pro Wordpress Chatbot = 13.6.5 versions...
PT-2026-50320
Subscriber Arbitrary File Upload in Charity Zone = 1.1.1 versions...
PT-2026-50419
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.109...
PT-2026-50395
Unauthenticated PHP Object Injection in PressMart = 1.2.26 versions...
PT-2026-50349
Unauthenticated SQL Injection in JetEngine = 3.8.10.1 versions...
CVE-2026-1288: NULL Pointer Dereference
A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition...
PT-2026-50358
Subscriber Privilege Escalation in Falang multilanguage = 1.4.2 versions...
PT-2026-50280
Unauthenticated Local File Inclusion in Reprizo = 1.0.8 versions...
CVE-2025-69131: Improper Limitation of a Pathname to a Restricted Directory
Unauthenticated Arbitrary File Download in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site = 1.0.7 versions...
CVE-2026-22334: Improper Limitation of a Pathname to a Restricted Directory
Subscriber Arbitrary File Download in Woocommerce Book Price = 1.3 versions...
PT-2026-50279
Unauthenticated Local File Inclusion in Promo = 1.3.0 versions...