EUVD-2026-54146

A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWidgetHtmlRenderer.java of the component Chart Name Handler. This manipulation of the argument Title causes cross site scripting. It is...

EUVD-2026-54248

A Server-Side Template Injection SSTI vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated attackers to execute arbitrary code as root...

CVE-2026-19110

A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWidgetHtmlRenderer.java of the component Chart Name Handler. This manipulation of the argument Title causes cross site scripting. It is...

CVE-2026-19110

DataGear up to 5.0.0 contains a stored cross-site scripting issue in the function HtmlTplDashboardWidgetHtmlRenderer of HtmlTplDashboardWidgetHtmlRenderer.java within the Chart Name Handler. The vulnerability is triggered by manipulation of the Title argument, allowing remote initiation of the at...

CVE-2026-15733 WGDashboard Remote Code Execution vulnerability

A Remote Code Execution RCE vulnerability exist in WGDashboard version 4.2.3 and earlier. Multiple OS command injection allows authenticated attackers to execute arbitrary commands as root...

Malicious code in nms-dashboard-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab87107c47e765b4214ccd31eac720d9d082b0cb5040d8acf90c8af00db5a601 [email protected] declares an npm install lifecycle hook scripts.install: "node index.js" that unconditionally requires ./lib/core inside a...

MAL-2026-13451 Malicious code in nms-dashboard-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab87107c47e765b4214ccd31eac720d9d082b0cb5040d8acf90c8af00db5a601 [email protected] declares an npm install lifecycle hook scripts.install: "node index.js" that unconditionally requires ./lib/core inside a...

WordPress WPMU DEV Dashboard plugin <= 5.0.0 - Authentication Bypass to Arbitrary plugin Installation (Remote Code Execution) vulnerability

Authentication Bypass to Arbitrary plugin Installation Remote Code Execution vulnerability discovered by Austin Ginder in WordPress Plugin WPMU DEV Dashboard versions = 5.0.0...

CVE-2026-15459

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the...

CVE-2026-15459

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the...

CVE-2026-15459 WPMU DEV Dashboard <= 5.0.0 - Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= Endpoint

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the...

WordPress Material Dashboard plugin <= 1.4.10 - Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion vulnerability

Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin Material Dashboard versions = 1.4.10...

CVE-2026-6079

The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the amdajaxtargettaskmanager function in all versions up to, and including, 1.4.10. This makes it possible for unauthenticated attackers to enumerate all...

CVE-2026-6079

Material Dashboard for WordPress (plugin) up to version 1.4.10 is vulnerable to missing authorization in the amd_ajax_target_task_manager() pathway, allowing unauthenticated attackers to enumerate all scheduled tasks, execute arbitrary tasks, and delete tasks via public_amd_ajax_handler. The unde...

EUVD-2026-53174

The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the amdajaxtargettaskmanager function in all versions up to, and including, 1.4.10. This makes it possible for unauthenticated attackers to enumerate all...

CVE-2026-6079 Material Dashboard <= 1.4.10 - Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion

The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the amdajaxtargettaskmanager function in all versions up to, and including, 1.4.10. This makes it possible for unauthenticated attackers to enumerate all...

CVE-2026-49132

OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloads in the certificate description field via the trust certificate API. The unsanitized description value is persisted and later...

CVE-2026-49132 OPNsense < 26.1.9 Stored XSS via Certificate Description Field

OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloads in the certificate description field via the trust certificate API. The unsanitized description value is persisted and later...

CVE-2026-49132

OPNsense before 26.1.9 is affected by a stored XSS in the trust certificate API: when an attacker consolidates payloads into a certificate description, the unsanitized value is persisted and later rendered in the Dashboard Certificates widget (Certificates.js) via HTML attribute/text sinks, allow...

CVE-2026-49132 OPNsense < 26.1.9 Stored XSS via Certificate Description Field

OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloads in the certificate description field via the trust certificate API. The unsanitized description value is persisted and later...