44477 matches found
PT-2026-50398
Unauthenticated PHP Object Injection in Konsept = 1.9 versions...
PT-2026-50374
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themify Folo allows Reflected XSS. This issue affects Themify Folo: from n/a through 1.9.6...
The vulnerability of the Click-to-Run package services for Microsoft Office and Microsoft 365 Apps for Enterprise allows a perpetrator to enhance their privileges.
The vulnerability of the Click-to-Run package services for Microsoft Office and Microsoft 365 Apps for Enterprise lies in the ability to exploit memory after it is freed. Exploiting this vulnerability could allow an attacker to enhance their privileges...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization through the improper enforcement of access controls in the pull request creation and push authorization processes. An attacker can gain unauthorized write access to repositories by abusing the "Allow edits from...
n8n: Microsoft SQL Node Prototype Pollution
Impact An authenticated user with permission to create or modify workflows could achieve global prototype pollution via the Microsoft SQL node by supplying a crafted value as the table parameter. This pollutes Object.prototype process-wide for the lifetime of the n8n server process, causing...
GHSA-WW63-PV5X-VFC8 Daytona: Public sandbox previews remain accessible for up to one hour after being made private
Summary Sandbox previews that were switched from public to private could remain reachable without authentication for a short period after the change, due to a cached visibility state that was not invalidated when the sandbox's visibility changed. Impact When a sandbox owner changed a preview from...
CVE-2026-11409 OS Command Injection in IPv6 PPPoE Configuration in TP-Link TL-WR940N
An authenticated OS command injection vulnerability exists in the IPv6 PPPoE configuration handler in TL-WR940N v6 due to improper sanitization of user input. An attacker with administrative access may exploit this issue to execute arbitrary system commands with elevated privileges...
CVE-2026-40759 WordPress Esmée theme <= 1.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Esmée = 1.4 versions...
CVE-2026-40755 WordPress TechLink theme <= 1.3 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in TechLink = 1.3 versions...
CVE-2026-40755 WordPress TechLink theme <= 1.3 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in TechLink = 1.3 versions...
CVE-2026-40736
WordPress Laurits theme
CVE-2026-40736 WordPress Laurits theme <= 1.5.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Laurits = 1.5.1 versions...
CVE-2026-39580 WordPress Micdrop theme <= 1.3.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Micdrop = 1.3.1 versions...
CVE-2026-39578 WordPress Valiance theme <= 1.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Valiance = 1.2 versions...
CVE-2026-39578
CVE-2026-39578 refers to an unauthenticated PHP Object Injection in WordPress Theme Valiance versions
CVE-2026-39568 WordPress Mr. SEO theme <= 2.0 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Mr. SEO = 2.0 versions...
CVE-2026-39554 WordPress Fidalgo theme <= 1.2.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Fidalgo = 1.2.2 versions...
CVE-2026-39554
CVE-2026-39554 concerns WordPress Theme Fidalgo (versions