EUVD-2026-53258

The endpoint /v3/import/tokenclusterId.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/privateregistry.go causes the request to return HTTP 502...

CVE-2026-16940

The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary files on the server such as wp-config.php, which can lead to a full site takeover...

CVE-2026-15372

The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator...

CVE-2026-71212 xidown - Argument Injection via Unterminated yt-dlp Command Line Construction

xidown a yt-dlp/ffmpeg GUI wrapper builds its yt-dlp command-line invocation xidown/core/scanner.py and downloader.py by appending the user-provided or scanned URL as a bare trailing positional argument, with no '--' end-of-options marker and no scheme validation anywhere in the codebase...

CVE-2026-71212 xidown - Argument Injection via Unterminated yt-dlp Command Line Construction

xidown a yt-dlp/ffmpeg GUI wrapper builds its yt-dlp command-line invocation xidown/core/scanner.py and downloader.py by appending the user-provided or scanned URL as a bare trailing positional argument, with no '--' end-of-options marker and no scheme validation anywhere in the codebase...

CVE-2026-71212

xidown a yt-dlp/ffmpeg GUI wrapper builds its yt-dlp command-line invocation xidown/core/scanner.py and downloader.py by appending the user-provided or scanned URL as a bare trailing positional argument, with no '--' end-of-options marker and no scheme validation anywhere in the codebase. Because...

CVE-2026-71212

xidown (a yt-dlp/ffmpeg GUI wrapper) constructs its yt-dlp command by appending a user-supplied URL as a bare trailing positional argument, with no end-of-options marker (-- or scheme validation). Because yt-dlp treats any argument starting with '-' as an option, a crafted URL such as -U or --exe...

CVE-2026-71211

MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...

EUVD-2026-53208

MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...

EUVD-2026-53207

Mealie's AsyncSafeTransport SSRF guard mealie/pkgs/safehttp/transport.py resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independentl...

EUVD-2026-53203

Shiori's CheckToken function internal/domains/auth.go validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase. Deleting an account or...

CVE-2026-71203 changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema

changedetection.io's REST API resources are protected by an @auth.checktoken decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec changedetectionio/api/Spec.py, whose get method carries neither @auth.checktoken nor @validateopenapirequest...

CVE-2026-70378 imagecli - Negative carve Ratio Bypasses Bounds Check and Crashes Process via Reachable Panic

imagecli's pipeline operation Carve::apply in src/imageops.rs only asserts , never validating that the ratio is positive. A negative ratio e.g. -5 causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to imageproc::seamcarving::shrinkwidth —...

EUVD-2026-53198

imagecli's carve pipeline operation Carve::apply in src/imageops.rs only asserts ratio = 1.0, never validating that the ratio is positive. A negative ratio e.g. -5 causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to...

CVE-2026-7444

The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the processbulkaction function of MWTSAStatsTable. This makes it possible for unauthenticated attacker...

CVE-2026-7444

CVE-2026-7444 affects the WordPress plugin Search Analytics for WP (

CVE-2026-6147

The LightSync Pro WordPress plugin is affected by an insecure file upload vulnerability due to missing file type validation in rest_replace_media() in all versions up to and including 2.1.6. The flaw allows authenticated attackers with Author-level access or higher to upload arbitrary files on th...

CVE-2026-6147 LightSync Pro <= 2.1.6 - Authenticated (Author+) Arbitrary File Upload

The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the restreplacemedia function in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Author-level access and above, to upload...

EUVD-2026-53115

The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied content type and preserving the original file extension, allowing any authenticated user Subscriber or higher to upload arbitrary PHP files and achieve remote code execution...

EUVD-2026-52931

Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that allows admin-privileged attackers to direct the server to probe internal network resources by supplying arbitrary URLs to the embedding endpoint configuration without scheme, host, IP range, or DNS rebind...