CVE-2026-114375

A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/handlers/files.go of the component Files Rename API. Performing a manipulation of the argument currentPath/newName results in path traversal. The attack can ...

CVE-2026-114376

A weakness has been identified in leomoon-studios wiki-go up to 1.9.1. Affected by this vulnerability is the function SaveHandler/SourceHandler of the file internal/handlers/editor.go of the component API. Executing a manipulation can lead to path traversal. The attack can be launched remotely. T...

CVE-2026-36956

CVE-2026-36956: Cross-Site Request Forgery CSRF in Web Management Interface CVE ID: CVE-2026-36956 Date: 2026-04-29 Discoverer: Kirubel Solomne Vendor: Shenzhen Dibit Network Equipment Co., Ltd. Product: Dbit Router Firmware Version: V1.0.0 CWE: CWE-352 - Cross-Site Request Forgery CSRF Descripti...

CVE-2026-113094

A flaw was found in chromium-browser. A remote attacker can trigger memory corruption in the application programming interface API by convincing a user to visit a specially crafted HTML page. Successful exploitation could allow the attacker to execute arbitrary code within the browser's sandbox...

CVE-2026-1457

CVE-2026-1457: TP-Link VIGI C385 Authenticated Remote Code Execution Overview CVE-2026-1457 is an authenticated buffer overflow vulnerability in the web API of TP-Link VIGI C385 V1. This vulnerability allows authenticated attackers to perform remote code execution RCE. CVSS v4.0 Score: 8.5 High...

CVE-2024-6624

CVE-2024-6624 | JSON API User = 3.9.3 - Unauthenticated Privilege Escalation This is a Python script that exploits the CVE-2024-6624 vulnerability in the JSON API User = 3.9.3 plugin for WordPress. This tool allows unauthenticated attackers to register new users and escalate their privileges to...

CVE-2025-56221

CVE-2025-56221 Improper Restriction of Excessive Authentication Attempts Description An attacker can make unlimited authentication attempts, increasing the risk of compromising targeted user accounts through password guessing. CVSS Score: 7.5 High Attack Type Remote Authenticated Affected Version...

EUVD-2026-107545

A weakness has been identified in leomoon-studios wiki-go up to 1.9.1. Affected by this vulnerability is the function SaveHandler/SourceHandler of the file internal/handlers/editor.go of the component API. Executing a manipulation can lead to path traversal. The attack can be launched remotely. T...

CVE-2026-114376

A path traversal vulnerability exists in the leomoon-studios wiki-go software in versions up to 1.9.1 . The flaw is located within the SaveHandler/SourceHandler function of the internal/handlers/editor.go file in the API component. A remote attacker can execute a manipulation to perform a path tr...

CVE-2026-114376 leomoon-studios wiki-go API editor.go SourceHandler path traversal

A weakness has been identified in leomoon-studios wiki-go up to 1.9.1. Affected by this vulnerability is the function SaveHandler/SourceHandler of the file internal/handlers/editor.go of the component API. Executing a manipulation can lead to path traversal. The attack can be launched remotely. T...

EUVD-2026-105143

Vitest: Servers misapply server.fs.deny, serving .env, private keys, .git, and the API token file...

CVE-2021-36460

CVE-2021-36460 NVD CVE-2021-36460: https://nvd.nist.gov/vuln/detail/CVE-2021-36460 MITRE CVE-2021-36460: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-36460 CWE-836: Use of Password Hash Instead of Password for Authentication The VeryFitPro app Android: com.veryfit2hr.second, iOS =3.3.7...

CVE-2026-31431-Copy-Fail

CVE-2026-31431 — Copy Fail Severity: Critical CVSS v3.1: 9.8 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Status: Public Exploit Available Summary CVE-2026-31431 "Copy Fail" is a local privilege escalation vulnerability in the Linux kernel cryptographic subsystem. Any unprivileged user can escalate to roo...

CVE-2026-114375

A path traversal vulnerability exists in the Files Rename API of leomoon-studios wiki-go up to version 1.9.1 . The flaw resides in the RenameFileHandler function within internal/handlers/files.go, where manipulating the currentPath/newName argument allows for remote path traversal. Public exploit...

EUVD-2026-107543

A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/handlers/files.go of the component Files Rename API. Performing a manipulation of the argument currentPath/newName results in path traversal. The attack can ...

CVE-2026-114375 leomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversal

A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/handlers/files.go of the component Files Rename API. Performing a manipulation of the argument currentPath/newName results in path traversal. The attack can ...

CVE-2026-114375 leomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversal

A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/handlers/files.go of the component Files Rename API. Performing a manipulation of the argument currentPath/newName results in path traversal. The attack can ...

CVE-2024-11423

CVE-2024-11423 Ultimate Gift Cards for WooCommerce = 3.0.6 - Missing Authorization to Infinite Money Glitch Description The Ultimate Gift Cards for WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Coupons. Offer Gift Certificates, Schedule Gift Cards, and U...

CVE-2025-56219

CVE-2025-56219 Lack of Rate Limiting – Add User API Description An attacker can automate the creation of a large number of Users in a short period of time to cause a DoS. CVSS Score: 7.1 High Attack Type Remote Authenticated Affected Versions Versions before 8.6.8 Discovered By: Yazan Abu-Nadi...

DEBIAN-CVE-2026-111804

Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...