GNUnet P2P Framework 0.26.2

GNUnet is a peer-to-peer framework with focus on providing security. All peer-to-peer messages in the network are confidential and authenticated. The framework provides a transport abstraction layer and can currently encapsulate the network traffic in UDP IPv4 and IPv6, TCP IPv4 and IPv6, HTTP, o...

EUVD-2026-52886

An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator LXCO 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system commands as a privileged user under a specific circumstance...

CVE-2026-13229 Zammad 7.0.1 - Improper authorization in ticket article attachment cloning

Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint...

EUVD-2026-52851

SnailJob 1.7.0 contains a denial of service vulnerability in the FuryUtil.deserialize helper that allows authenticated attackers to crash the server by supplying a crafted Zstandard-compressed payload with an inflated framecontentsize field in the frame header. Attackers can store a base64-encode...

CVE-2026-18830

The CVE-2026-18830 issue affects the Amazon Bedrock AgentCore harness, specifically the InvokeHarness API. It arises from insufficient input validation in, or surrounding, the harness, which could allow an authenticated remote user to execute configured tools by sending crafted content blocks in ...

CVE-2026-18830 Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API

Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to execute configured tools bypassing model invocation and security controls via crafted content blocks in conversation messages. AWS has addressed this issue. No customer action is required...

CVE-2026-69255

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent in packages/components/nodes/agents/CSVAgent/CSVAgent.ts extracted attacker-controlled CSV data with file.split','.pop and interpolated it directly into executable Python as...

CVE-2026-15314

Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in the handling of authenticated HTTP request bodies due to insufficient input validation before memory copy operations. This may lead to buffer overflow condition, causing the web service process to crash...

CVE-2026-15314

Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in the handling of authenticated HTTP request bodies due to insufficient input validation before memory copy operations. This may lead to buffer overflow condition, causing the web service process to crash...

CVE-2026-69256

Flowise CVE-2026-69256 affects the CSVAgent node prior to version 3.1.3. A user-supplied customReadCSVFunc is evaluated as pd.${customReadCSVFunc} and can execute via Pyodide, bypassing a denylist with a pandas.read_pickle payload. An authenticated user who can create/modify a chatflow can add th...

EUVD-2026-52746

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.readpickle could deserialize a pickled...

EUVD-2026-52739

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow — ran code in the in-process vm2 sandbox. To build that code, they inserted a user-controlled...

Dolibarr <=22.0.4 - Local File Inclusion

Dolibarr = 22.0.4 contains a local file inclusion caused by manipulation of the objectdesc parameter and a fail-open logic flaw in restrictedArea in /core/ajax/selectobject.php, letting authenticated users with no specific privileges read arbitrary non-PHP files. id: CVE-2026-34036 info: name:...

Meta Box <= 5.11.1 - Arbitrary File Deletion

The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajaxdeletefile function. This makes it possible for authenticated attackers with Contributor-level access and above to delete arbitrary files on the server. id: CVE-2026-3946...

Faculty Evaluation System v1.0 - SQL Injection

Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/managetask.php?id= id: CVE-2023-33439 info: name: Faculty Evaluation System v1.0 - SQL Injection author: Harsh severity: high description: | Sourcecodester Faculty Evaluation System v1.0 is vulnerable to...

Tiempo.com <= 0.1.2 - Cross-Site Scripting

Tiempo.com before 0.1.2 is susceptible to cross-site scripting via the page parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to stea...

Directorist < 7.5.4 - Local File Inclusion

Directorist before 7.5.4 is susceptible to Local File Inclusion as it does not validate the file parameter when importing CSV files. id: CVE-2023-2252 info: name: Directorist 7.5.4 - Local File Inclusion author: r3Y3r53 severity: low description: | Directorist before 7.5.4 is susceptible to Local...

Newsletter < 7.6.9 - Cross-Site Scripting

The plugin does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators id: CVE-2023-27922 info: name: Newsletter 7.6.9 - Cross-Site Scripting author: r3Y3r53 severity: medium...

WordPress GN Publisher <1.5.6 - Cross-Site Scripting

WordPress GN Publisher plugin before 1.5.6 is susceptible to cross-site scripting via the tab parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow th...

Slimstat Analytics < 4.9.3.3 Subscriber - SQL Injection

The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL query. id: CVE-2023-0630 info: name: Slimstat Analytics 4.9.3.3 Subscriber - SQL Injection author: DhiyaneshDK severity: high description...