EUVD-2026-49656

Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.6 versions...

EUVD-2026-49667

Unauthenticated Server Side Request Forgery SSRF in Simple Link Directory Pro = 15.0.6 versions...

CVE-2026-61953

Unauthenticated Server Side Request Forgery SSRF in Simple Link Directory Pro = 15.0.6 versions...

CVE-2026-55578

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shellexec. After the fix for GHSA-9643-6xjp-vx57 which...

CVE-2026-55579

CVE-2026-55579 affects the PHP single-file editor Pheditor. From 2.0.1 up to before 2.0.6, it ships with a hardcoded default password (admin) whose SHA-512 hash is in pheditor.php:11, with no mechanism to force a first-login password change. An attacker using the default credentials gains full ac...

CVE-2026-66433

Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...

EUVD-2026-49242

Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...

CVE-2025-13146 Contact Form 7 – Dynamic Text Extension <= 5.0.6 - Unauthenticated Arbitrary Shortcode Execution

The The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.6. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This...

CVE-2025-13146

The CVE-2025-13146 entry affects the WordPress plugin “Contact Form 7 – Dynamic Text Extension.” The vulnerability allows unauthenticated attackers to execute arbitrary shortcodes by exploiting improper validation before do_shortcode, impacting all versions up to 5.0.6. A partial fix was introduc...

EUVD-2025-210494

The The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.6. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This...

ROOT-OS-DEBIAN-13-CVE-2026-53106 CVE-2026-53106 in rootio-linux - Patched by Root

Root has patched CVE-2026-53106 in the rootio-linux package for Root:Debian:13. Multiple fixed versions available...

CVE-2026-60602

The CVE affects Oracle PeopleSoft Enterprise CS Student Financials Billing (component: Billing), specifically version 9.2.38. It describes a vulnerability that lets a low-privileged user with network access via HTTP compromise the system and potentially takeover PeopleSoft CS Student Financials. ...

PYSEC-2026-2626 Neo4j Labs MCP Servers: SSRF and Data Modification via read_only Mode Bypass Through CALL Procedures

Summary The readonly mode in mcp-neo4j-cypher versions prior to 0.6.0 can be bypassed using CALL procedures. Details Impact The enforcing of readonly mode in vulnerable versions could be bypassed by certain APOC procedures. Patches v0.6.0 release hardened the checks around the mode. The only way ...

PT-2026-57334

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 16.16.0 Frappe versions prior to 15.106.0 Description User enumeration is possible through the 'reset password' endpoint. User enumeration is a technique used to verify if a specific user exists within a system by...

CVE-2026-15163

CVE-2026-15163 affects Wireshark up to 4.6.6 and 4.4.16, where multiple protocol dissectors can enter infinite loops due to an unreachable exit condition, causing denial of service (application unresponsiveness). Severity varies by source: NVD lists CVSSv3.1 impact as High (AV:N/AC:L/PR:N/UI:N/S:...

CVE-2026-14791 crater-invoice-inc crater Invoice Note InvoicesRequest.php getFormattedString cross site scripting

A weakness has been identified in crater-invoice-inc crater up to 6.0.6. This affects the function getFormattedString of the file app/Http/Requests/InvoicesRequest.php of the component Invoice Note Handler. Executing a manipulation of the argument notes can lead to cross site scripting. The attac...

DEBIAN-CVE-2026-13149

brace-expansion through 5.0.6 is vulnerable to denial of service. The expand function exhibits exponential-time complexity in the number of consecutive non-expanding '' brace groups. An attacker who passes a crafted string to expand, directly or transitively, can cause significant CPU consumption...

PT-2026-52476

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0670 Description The get text props function in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop T entries that follow. Because the count ...

EUVD-2026-38641

Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. parseEfiSignatureList does not advance the buffer past vendor bytes before reading entries. For hashSHA256SigGUID lists, this allows attacker-controlled vendor header bytes to be appended ...

CVE-2026-47240

Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a "raw data" argument that is sent verbatim after validation to prevent command injection. However, if a server does not support non-synchronizing...