Malicious code in flask-header-guard (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5e0cbaefa0fcface340b03a236573ed70df9b4d7773715321df057a9862e3f8 The package is presented as Flask security-headers middleware but ships a hostile payload wired to fire at install time and again whenever the librar...

RaspAP 2.8.7 - Unauthenticated Command Injection

A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfgid parameter in /ajax/openvpn/activateovpncfg.php and /ajax/openvpn/delovpncfg.php. id: CVE-2022-39986 info: name: RaspAP 2.8.7 - Unauthenticated Command Injectio...

Zoho manageengine - Cross-Site Scripting

Zoho manageengine is vulnerable to reflected cross-site scripting. This impacts Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 via the...

Apache Struts2 S2-052 - Remote Code Execution

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type of filtering, which can lead to remote code execution when deserializing XML payloads. id: CVE-2017-9805 info: name:...

WordPress Chop Slider 3 - Blind SQL Injection

WordPress Chop Slider 3 plugin contains a blind SQL injection vulnerability via the id GET parameter supplied to getscript/index.php. The plugin can allow an attacker to execute arbitrary SQL queries in the context of the WP database user, thereby making it possible to obtain sensitive informatio...

FLIR AX8 1.46.16 - Remote Command Injection

FLIR AX8 version 1.46.16 and below is susceptible to an unauthenticated remote command injection vulnerability.The vulnerability exists in the alarm functionality where user-supplied input in the 'id' parameter is not properly sanitized,allowing attackers to inject and execute arbitrary OS...

sctp: validate Adaptation Indication parameter length

...

CVE-2026-81342

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs...

CVE-2026-17522

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin...

CVE-2026-81342 MasterStudy LMS < 3.7.43 - Unauthenticated Open Redirect

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs...

EUVD-2026-68064

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs...

CVE-2026-81342

MasterStudy LMS WordPress Plugin versions prior to 3.7.43 are affected by an unauthenticated open redirect . The plugin fails to validate a redirect parameter supplied during user registration before using it, allowing an attacker to redirect users to arbitrary external URLs. The vulnerability re...

CVE-2026-81342 MasterStudy LMS < 3.7.43 - Unauthenticated Open Redirect

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs...

CVE-2026-17522 Newsletters < 4.17 - Arbitrary Plugin Option Update via CSRF

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin...

EUVD-2026-68046

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin...

CVE-2026-17522 Newsletters < 4.17 - Arbitrary Plugin Option Update via CSRF

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin...

CVE-2026-17522

The Newsletters WordPress plugin before 4.17 is vulnerable to Cross-Site Request Forgery (CSRF) due to a missing nonce or capability check when saving one of its settings screens. The plugin writes every submitted parameter into its own options, allowing an attacker to trick a logged-in administr...

Exploit for CVE-2026-82286

CVE-2026-82286 — gpt-crawler Unauthenticated Arbitrary File Wr...

EUVD-2026-67937

A buffer overflow vulnerability exists in the embedded HTTP service in TL-WR841N v14 when processing multipart/form-data requests. Insufficient validation of an attacker-controlled boundary parameter may allow a remote unauthenticated attacker to submit a crafted request that corrupts memory by...

EUVD-2026-67961

IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned configuration area read by the signed bootloader...