50807 matches found
PT-2026-50333
Unauthenticated Broken Authentication in WooCommerce Dropshipping = 5.2.4 versions...
CVE-2026-36418
JimuReport versions 2.3.4 and below are vulnerable to remote code execution due to improper handling of Aviator expressions. The /jmreport/executeSelectApi endpoint passes user-supplied input directly to the Aviator expression engine without adequate validation allowing attackers to execute...
PT-2026-50402
Unauthenticated Local File Inclusion in Atomlab = 2.4.5 versions...
PT-2026-50304
Unauthenticated Local File Inclusion in Malmö = 2.2 versions...
PT-2026-50313
CP Client Arbitrary File Download in Client Portal Pro = 5.6.2 versions...
PT-2026-50438
Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description A flaw in the ngx http proxy v2 module and ngx http grpc module modules allows a remote, unauthenticated attacker to trigger a heap-based...
PT-2026-50326
Unauthenticated PHP Object Injection in AI Lab 5.4.2 versions...
PT-2026-50312
Subscriber Broken Access Control in Bricks Builder = 2.1.4 versions...
PT-2026-50248
Name of the Vulnerable Software and Affected Versions NVIDIA NeMo for Linux affected versions not specified Description An issue exists that allows an attacker to perform OS command injection. This could result in arbitrary code execution, data tampering, escalation of privileges, and information...
PT-2026-50329
Subscriber Broken Access Control in WPBakery Page Builder = 8.7.2 versions...
nginx -- multiple vulnerabilities
The nginx developers report: A heap memory buffer overflow vulnerability when using the "ignoreinvalidheaders off;" and "largeclientheaderbuffers" directives with large configured values while proxying a specially crafted request to an HTTP/2 or gRPC backend may allow memory corruption or a...
nginx -- multiple vulnerabilities
The nginx developers report: A use-after-free vulnerability when using HTTP/3 and processing a specially crafted QUIC session may allow memory corruption or a segmentation fault in a worker process CVE-2026-42530. A heap memory buffer overflow vulnerability when using the "ignoreinvalidheaders...
PT-2026-50503
Name of the Vulnerable Software and Affected Versions Connext Professional versions 7.4.0 through 7.6.x Connext Professional versions 7.0.0 through 7.3.1.2 Connext Professional versions 6.1.0 through 6.1.x Connext Professional versions 6.0.0 through 6.0.x Connext Professional versions 5.3.0 throu...
PT-2026-50357
Subscriber Broken Authentication in Melhor Envio = 2.16.3 versions...
PT-2026-50332
Unauthenticated Privilege Escalation in LoginPress Pro = 6.2.2 versions...
PT-2026-50342
Unauthenticated Sensitive Data Exposure in JetBlog = 2.4.8 versions...
📄 Grav CMS Remote Code Execution
This Python exploit targets a vulnerability in Grav CMS versions prior to 2.0.0-beta.2 by abusing the administrative Direct Install plugin feature to achieve remote code execution...
PT-2026-50584
Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.26.2 Description Authenticated self routes under the /api/v1/user/... group do not properly enforce the public-only token restriction. This allows a token or OAuth grant marked as public-only to access or modify priva...