57370 matches found
CVE-2026-58055
A flaw in nghttp2's nghttpx proxy allows a remote attacker to perform HTTP request smuggling and cross-client response-queue poisoning. This occurs because the proxy ambiguously forwards HTTP/1.1 Upgrade requests that contain a Content-Length header to reusable keep-alive backend connections...
CVE-2026-57309
A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP header resulting in Blind SQL Injection. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in versi...
CVE-2026-57310 Weak password hashing in Windu CMS
Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtain password hash to decode user credentials. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 4.1 but may also...
EUVD-2026-45943
A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP header resulting in Blind SQL Injection. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in versi...
Path Traversal
phpMyFAQ is vulnerable to Path Traversal. The vulnerability is due to improper path validation during PDF generation, where attacker-controlled image paths are passed to filegetcontents without canonicalization or directory containment checks, allowing authenticated users to read files outside th...
httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc
A flaw was found in Apache HTTP Server, specifically within the modxml2enc module. This heap-based buffer overflow vulnerability can be triggered when processing untrusted content through the xml2StartParse function. A remote attacker could potentially exploit this to cause a denial of service,...
httpd: incomplete fix for CVE-2023-38709
A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers. These issues lead to HTTP response splitting. This CVE provides a "complete" fix for CVE-2023-38709...
Arbitrary File Upload
TYPO3 CMS is vulnerable to Arbitrary File Upload. The vulnerability is due to missing server-side enforcement of configured MIME type restrictions, where uploaded files are not validated against allowed MIME types, allowing attackers to upload files with arbitrary MIME types...
CVE-2026-10724
The CVE concerns The Reviews Feed WordPress plugin prior to 2.6.5. The vulnerability arises because the plugin does not neutralize WordPress shortcodes present in third-party review content before rendering it via its dynamic block. This allows unauthenticated attackers to execute arbitrary short...
CVE-2026-10724
The Reviews Feed WordPress plugin before 2.6.5 does not neutralize WordPress shortcodes contained in third-party review content before rendering it through its dynamic block, allowing unauthenticated attackers to execute arbitrary shortcodes on pages that display the feed by planting a shortcode ...
CVE-2026-45138
CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom htmlpurify validation rule used to sanitize blog post bodies relies on by-reference mutation ?string &$str, but CodeIgniter 4's validator passes a local copy of the value, so the sanitized tex...
IBM Langflow OSS path traversal vulnerability (CNVD-2026-31206)
IBM Langflow OSS is an open-source low-code visualization AI workflow building tool developed by IBM. It enables developers to quickly build, deploy, and iterate AI agents and RAG applications by dragging and dropping components. Additionally, it supports deep customization using Python to...
The vulnerability of the Content Credentials SDK libraries, related to insufficient validation of input data, allows attackers to circumvent existing security restrictions.
The vulnerability of the Content Credentials SDK libraries is related to insufficient validation of input data. Exploiting this vulnerability could allow attackers to circumvent existing security restrictions...
The vulnerability of the Content Credentials SDK library, related to uncontrolled resource consumption, allows a hacker to cause a service failure.
The vulnerability of the Content Credentials SDK libraries is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a perpetrator to cause service failures...
The vulnerability of the Content Credentials SDK library, related to integer overflow, allows a malicious actor to cause a service failure.
The vulnerability of the Content Credentials SDK libraries is related to a potential overflow condition. Exploiting this vulnerability could allow an attacker to cause a service failure...
The vulnerability of the Content Credentials SDK libraries, related to insufficient validation of input data, allows attackers to read arbitrary files.
The vulnerability of the Content Credentials SDK libraries is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to read arbitrary files...
The vulnerability of the Content Credentials SDK library, related to integer overflow, allows a malicious actor to cause a service failure.
The vulnerability of the Content Credentials SDK libraries is related to a potential overflow condition. Exploiting this vulnerability could allow an attacker to cause a service failure...
The vulnerability of the Content Credentials SDK libraries, related to insufficient protection of registration data, allows attackers to enhance their privileges.
The vulnerability of Content Credentials SDK libraries is related to insufficient protection of registration data. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...
The vulnerability of the Content Credentials SDK libraries lies in the insufficient validation of requests on the server side, allowing attackers to increase their privileges.
The vulnerability of the Content Credentials SDK libraries is related to insufficient validation of requests at the server side. Exploiting this vulnerability can allow attackers to enhance their privileges...
The vulnerability of the Content Credentials SDK library, related to integer overflow, allows a malicious actor to cause a service failure.
The vulnerability of the Content Credentials SDK libraries is related to a potential overflow condition. Exploiting this vulnerability could allow an attacker to cause a service failure...