59038 matches found
CVE-2026-72832
Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. The event-handler scan is anchored at ?, which cannot cross the first literal ; when a appears inside a quoted attribute value the...
CVE-2026-72832 Grav before 2.0.12 Stored XSS via quoted-attribute bypass
Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. The event-handler scan is anchored at ?, which cannot cross the first literal ; when a appears inside a quoted attribute value the...
CVE-2026-72815
go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...
EUVD-2026-58625
SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfiltered edits. Attackers can establish a WebSocket connection to the publish surface and passively receive real-time content events including...
CVE-2026-72810
SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfiltered edits. Attackers can establish a WebSocket connection to the publish surface and passively receive real-time content events including...
CVE-2026-72811 SiYuan before v3.7.4 SQL Injection via backlink search
SiYuan versions = v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query kernel/model/backlink.go, which concatenates stored block metadata title, name, alias, anchor text and the client-supplied keyword into a SQL MATCH/search statement while escaping only the...
WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Vavo Core versions = 2.3.0...
WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by hhhai in WordPress Plugin WP Sort Order versions = 1.3.5...
WordPress Epeken All Kurir plugin <= 2.1.2 - Unauthenticated Order Payment Confirmation Forgery vulnerability
Unauthenticated Order Payment Confirmation Forgery vulnerability discovered by Pedro Pinho in WordPress Plugin Epeken All Kurir versions = 2.1.2...
WordPress Wishlist Member X plugin <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter vulnerability
Unauthenticated Account Takeover via 'mergewith' Parameter vulnerability discovered by bashu - VN in WordPress Plugin WishList Member X versions = 3.34.1...
WordPress WP Helper Premium plugin < 4.7.6 - Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation vulnerability
Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation vulnerability discovered by Farid Narimanov in WordPress Plugin WP Helper Premium versions 4.7.6...
CVE-2026-65975
A flaw was found in Pydantic AI's UI adapters, specifically within the sanitizemessages function. This vulnerability allows a remote client to bypass security checks and execute server tools with arguments they provide, rather than those generated by the AI model. This occurs when a trailing clie...
GO-2026-5711 vulnerabilities
Vulnerabilities for packages: tekton-pipelines-fips, tekton-chains-fips, tekton-chains, tekton-pipelines, tkn-fips, tkn...
GO-2026-5102 vulnerabilities
Vulnerabilities for packages: kuma...
GO-2025-3793 vulnerabilities
Vulnerabilities for packages: filebrowser...
GO-2026-4344 vulnerabilities
Vulnerabilities for packages: filebrowser...
GO-2024-2618 vulnerabilities
Vulnerabilities for packages: falcosidekick, guac, falcosidekick-fips...
GO-2025-4103 vulnerabilities
Vulnerabilities for packages: virt-api, virt-handler, virt-controller-fips, docker-machine-driver-harvester, virt-launcher, virt-operator-fips, virt-operator, virt-handler-fips, virt-api-fips, virt-controller...