47473 matches found
geoserver-0day-rce
GeoServer SQL Injection to RCE Zero-Day CVE: None yet?...
CVE-2026-15066
The Loco Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PO File Extracted Comments in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with translator-level...
CVE-2026-15066
The CVE-2026-15066 entry concerns the WordPress plugin Loco Translate. All versions up to 2.8.7 are reported vulnerable to Stored Cross-Site Scripting via PO file extracted comments caused by insufficient input sanitization and output escaping. Authenticated users with translator-level access or ...
EUVD-2026-59864
The Loco Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PO File Extracted Comments in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with translator-level...
CVE-2026-15066 Loco Translate <= 2.8.7 - Authenticated (Translator+) Stored Cross-Site Scripting via PO File Extracted Comments
The Loco Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PO File Extracted Comments in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with translator-level...
CVE-2026-15066 Loco Translate <= 2.8.7 - Authenticated (Translator+) Stored Cross-Site Scripting via PO File Extracted Comments
The Loco Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PO File Extracted Comments in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with translator-level...
CVE-2026-15066
The Loco Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PO File Extracted Comments in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with translator-level...
PT-2026-73155
Name of the Vulnerable Software and Affected Versions Scriban versions prior to 7.0.0 Description An uncontrolled recursion issue exists in the object.to json builtin function due to a lack of depth limits and circular reference detection. An attacker can create templates containing...
PT-2026-73070
A security vulnerability has been detected in Tenda AC10 16.03.10.09 multi TDE01. This vulnerability affects the function R7WebsSecurityHandler of the component httpd. The manipulation leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed publicly...
PT-2026-73095
The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSol handleFileUpload function. This is due to missing validation of the attacker-controlled Content-Disposition header filename, which overrides the...
PT-2026-73089
The Loco Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PO File Extracted Comments in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with translator-level...
PT-2026-73143
SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth middleware. The middleware accepts the API token Conf.Api.Token via an Authorization header Token/Bearer or a ?token= query parameter, and neither path is...
PT-2026-73148
Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on...
PT-2026-73100
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditions logic gates the current user can'edit user', $user id authorization check behind an is numeric test,...
SUSE CVE-2026-74492
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: do not update comments from kernel-side hash adds mtyperesize copies comment pointers with memcpy, not the comment objects themselves. During the window after an entry has been copied but before the table swap a...
WALLABAG-FULL-DISCLOSURE-Stored-XSS-SSRF-CVSS-8.5-GHSA-q2g2-
WALLABAG-FULL-DISCLOSURE-Stored-XSS-SSRF-CVSS-8.5-GHSA-q2g2- T...
MAL-2026-14062 Malicious code in tw-pkgprobe-7731 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12551ba52a9605fc8ce1e13b750671d201dcf2a6e23d03f5a23b15236f2fa49b On preinstall/postinstall, probe.js checks whether cwd matches a Twilio Serverless build path /tmp/AC/ and, if so, copies daemon.js to...
Malicious code in tw-pkgprobe-7731 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12551ba52a9605fc8ce1e13b750671d201dcf2a6e23d03f5a23b15236f2fa49b On preinstall/postinstall, probe.js checks whether cwd matches a Twilio Serverless build path /tmp/AC/ and, if so, copies daemon.js to...
DEBIAN-CVE-2026-74492
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: do not update comments from kernel-side hash adds mtyperesize copies comment pointers with memcpy, not the comment objects themselves. During the window after an entry has been copied but before the table swap a...
CVE-2026-74492
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: do not update comments from kernel-side hash adds mtyperesize copies comment pointers with memcpy, not the comment objects themselves. During the window after an entry has been copied but before the table swap a...