EUVD-2026-104460

Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a...

CVE-2026-112308

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validateurl private-address check. Attackers influencing agent tool input through prompt injection can direct...

XERJ Organization: XERJ Authorization Issues Vulnerability

The XERJ v1.0.0-rc.11 version has an authorization issue vulnerability. This vulnerability arises from the Bearer token being able to bypass the identity verification requirements of the restricted access key and directly call the API token to create endpoints. This may lead to the generation of...

Argo Project Argo CD Command Injection Vulnerability

The Argo CD versions from 2.7.0 to 3.3.15, 3.4.0-rc1 to 3.4.10, 3.5.0-rc1 to 3.5.4, and 3.6.0-rc1 to 3.6.0-rc2 have a command injection vulnerability. This vulnerability arises due to Kustomize failing to use an option end separator when passing query values for ref or version from remote...

Aspose PDF Exporter path traversal vulnerability

Versions of Aspose PDF Exporter 2.0 prior to version 2.0 have a path traversal vulnerability. This vulnerability stems from the use of the file parameter, which is not properly cleaned up when passed to the readfile function. This allows for path traversal attacks; unauthenticated attackers can...

IBM Verify Identity Access Trust Management Vulnerability

The IBM Verify Identity Access version 11.0.3.1 and the IBM Security Verify Access Appliance version 10.0.9.3 have vulnerabilities related to trust management. These vulnerabilities stem from the use of hardcoded credentials, which may allow attackers located physically nearby to obtain elevated...

Eosphoros DB-GPT Trust Management Vulnerabilities

eosphoros DB-GPT versions 0.8.2 and earlier have a trust management vulnerability. This vulnerability stems from hard-coded credentials in the default docker-compose.yml file. A static MYSQLROOTPASSWORD is set, and port 3306 is exposed on all interfaces. An attacker can authenticate as root@% and...

Argo Project Argo CD Software Supply Chain Vulnerabilities

The Argo Project’s Argo CD versions from 2.1.0 to 3.3.15, 3.4.0-rc1 to 3.4.10, 3.5.0-rc1 to 3.5.4, and 3.6.0-rc1 to 3.6.0-rc2 contain software supply chain vulnerability issues. This vulnerability arises when --enable-helm is enabled for kustomize builds, allowing helmGlobals.configHome to point ...

ChurcHope path traversal vulnerability

The ChurchHope theme for WordPress versions prior to 2.2 has a path traversal vulnerability. This vulnerability stems from the file parameter in /wp-content/themes/churchope/lib/downloadlink.php, which allows for path traversal. This could allow unauthorized attackers to download arbitrary files...

ProjectDiscovery Nuclei Templates path traversal vulnerability

Versions prior to ProjectDiscovery Nuclei Templates 3.0 contain a path traversal vulnerability. This stems from improper sanitization of the ‘file’ parameter, allowing unauthorized attackers to download arbitrary files by sending a GET request containing a path traversal sequence to...

WordPress Aspose Doc Exporter path traversal vulnerability

Versions of Aspose Doc Exporter 2.0 prior to version 2.0 contain a path traversal vulnerability. This vulnerability arises from the lack of cleaning the path passed to the readfile function. Unauthenticated attackers can download arbitrary files by sending a GET request with the file parameter...

Cherry Framework Cherry Plugin Path Traversal Vulnerability

The Cherry Framework and Cherry Plugin versions prior to 1.2.7 have a path traversal vulnerability. This vulnerability arises from the lack of validation for the file parameter input, allowing for path traversal attacks. An attacker could send a GET request to...

Curl information disclosure vulnerability

Versions 8.21.0 and 8.22.0 of curl contain an information disclosure vulnerability. This vulnerability arises when, during the use of environment user credentials, an HTTP request directed at a source may be sent via a previously authenticated Negotiate connection to a different source, resulting...

CVE-2026-112308

The crewai-tools library (through version 1.15.28 ) contains a Server-Side Request Forgery (SSRF) vulnerability within the SeleniumScrapingTool . The root cause is a failure to apply the validate_url private-address check, allowing attackers who can influence agent tool input via prompt injection...

CVE-2026-112308 crewai-tools through 1.15.28 SSRF via SeleniumScrapingTool

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validateurl private-address check. Attackers influencing agent tool input through prompt injection can direct...

EUVD-2026-104400

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validateurl private-address check. Attackers influencing agent tool input through prompt injection can direct...

CVE-2026-112308

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validateurl private-address check. Attackers influencing agent tool input through prompt injection can direct...

CVE-2026-112296

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain...

CVE-2026-112146

A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/emDaemon/passwd of the component MQTT Broker. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. The exploit is now public and m...

EUVD-2026-104276

A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/emDaemon/passwd of the component MQTT Broker. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. The exploit is now public and m...