289 matches found
NPM: Open WebUI Has Stored Cross-Site Scripting in SVG Renderer
NPM: Open WebUI Has Stored Cross-Site Scripting in SVG Renderer vulnerability discovered by ? in WordPress Npm open-webui versions 0.6.31...
WordPress SureTriggers plugin < 1.1.23 - Unauthenticated SQLi vulnerability
Unauthenticated SQLi vulnerability discovered by mcdruid in WordPress Plugin OttoKit versions 1.1.23...
CVE-2026-34001 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-4
CVE-2026-34001 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-4. A patched version of the package is available...
CVE-2026-41411 affecting package vim for versions less than 9.2.0392-1
CVE-2026-41411 affecting package vim for versions less than 9.2.0392-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-22336
CVE-2026-22336 affects the WordPress plugin Directorist Booking. It exposes an unauthenticated SQL Injection in versions up to 2.4.1, arising from improper neutralization of input used in SQL commands. Impact per sources is high: potential data disclosure or manipulation with no user interaction ...
Microsoft Edge (Chromium) < 147.0.3912.86 Multiple Vulnerabilities
The version of Microsoft Edge installed on the remote Windows host is prior to 147.0.3912.86. It is, therefore, affected by multiple vulnerabilities as referenced in the April 24, 2026 advisory. - Use after free in DevTools in Google Chrome prior to 147.0.7727.117 allowed a remote attacker who ha...
nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields
In versions middleware. Any user authenticated on the configured guard could call the endpoint and flip boolean attributes on any Nova resource — including users who do not have access to Nova itself for example, frontend customers sharing the web guard with the Nova admin area. The endpoint also...
CVE-2026-39979 affecting package jq for versions less than 1.7.1-5
CVE-2026-39979 affecting package jq for versions less than 1.7.1-5. A patched version of the package is available...
CVE-2026-33947 affecting package jq for versions less than 1.7.1-5
CVE-2026-33947 affecting package jq for versions less than 1.7.1-5. A patched version of the package is available...
CVE-2026-32316 affecting package jq for versions less than 1.7.1-5
CVE-2026-32316 affecting package jq for versions less than 1.7.1-5. A patched version of the package is available...
CVE-2026-34743 affecting package rust for versions less than 1.75.0-28
CVE-2026-34743 affecting package rust for versions less than 1.75.0-28. A patched version of the package is available...
PT-2026-33067
Name of the Vulnerable Software and Affected Versions Splunk MCP Server app versions prior to 1.0.3 Description A user with a role that has access to the Splunk internal index or the high-privilege capability mcp tool admin can view user session and authorization tokens in clear text. This issue...
CVE-2026-27171 affecting package rust for versions less than 1.72.0-15
CVE-2026-27171 affecting package rust for versions less than 1.72.0-15. A patched version of the package is available...
CVE-2026-25541 affecting package rust for versions less than 1.72.0-15
CVE-2026-25541 affecting package rust for versions less than 1.72.0-15. A patched version of the package is available...
CVE-2026-33412 affecting package vim for versions less than 9.2.0240-1
CVE-2026-33412 affecting package vim for versions less than 9.2.0240-1. An upgraded version of the package is available that resolves this issue...
CVE-2025-13822 Authentication bypass in MCPHub
MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allowing an unauthenticated attacker to perform actions in the name of other users and using their privileges...
EUVD-2026-21252
Samsung MagicINFO 9 Server Incorrect Default Permissions Local Privilege Escalation Vulnerability This issue affects MagicINFO 9 Server: less than 21.1091.1...
CVE-2026-21715 affecting package nodejs for versions less than 20.14.0-15
CVE-2026-21715 affecting package nodejs for versions less than 20.14.0-15. A patched version of the package is available...