WordPress Meta SEO <= 4.5.2 - Open Redirect

The WP Meta SEO WordPress plugin before 4.5.3 did not authorize several AJAX actions, which allowed low-privilege users to update certain data and resulted in an arbitrary redirect vulnerability. id: CVE-2023-0876 info: name: WordPress Meta SEO = 4.5.2 - Open Redirect author: Khalid6468 severity:...

CVE-2026-114466

Arbitrary data can be read or written through git-fast-import1 and git-fast-export1 features not marked unsafe...

CVE-2026-114466

A flaw in the Git git-fast-import(1) and git-fast-export(1) features allows for insufficient granularity of access control . Specifically, certain features within the fast-import utility do not properly restrict filesystem operations, enabling an attacker to supply crafted instructions to access ...

EUVD-2026-124399

Arbitrary data can be read or written through git-fast-import1 and git-fast-export1 features not marked unsafe...

CVE-2026-114466 Insufficient Granularity of Access Control in Git

Arbitrary data can be read or written through git-fast-import1 and git-fast-export1 features not marked unsafe...

CVE-2026-114466

Arbitrary data can be read or written through git-fast-import1 and git-fast-export1 features not marked unsafe...

CVE-2026-100144

The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database...

EUVD-2026-117349

The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database...

PT-2026-137391

Name of the Vulnerable Software and Affected Versions IVPAY payments versions prior to 1.0.9 Description The plugin fails to sanitize a value from its payment callback before incorporating it into a SQL statement. Additionally, the system accepts an empty API key, which is the default setting, as...

CVE-2026-107040

Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow...

CVE-2026-107032

Insecure permissions in Bulk Share : Location Sender v2.1.0 versionCode 5 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow...

CVE-2026-107027

Insecure permissions in lz233 Tarnhelm v1.8.2 versionCode 20250630 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting...

CVE-2026-107038: n/a: Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an…

Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data...

CVE-2026-107029: n/a: Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading…

Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting...

EUVD-2026-113174

Insecure permissions in Bulk Share : Location Sender v2.1.0 versionCode 5 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow...

CVE-2026-107029

Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting...

EUVD-2026-113176

Insecure permissions in lz233 Tarnhelm v1.8.2 versionCode 20250630 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting...

lz233 Tarnhelm security vulnerability

In version 1.8.2 of Tarnhelm, there is a security vulnerability stemming from insecure permissions on exported components. This may allow unauthorized attackers to invoke these exported components, leading to arbitrary data access and overwriting...

CVE-2026-107032

Insecure permissions in Bulk Share : Location Sender v2.1.0 versionCode 5 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow...

CVE-2026-107027

Insecure permissions in lz233 Tarnhelm v1.8.2 versionCode 20250630 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting...