23204 matches found
CVE-2026-75130
Context7 through 2.1.2 has a prompt injection flaw in its Custom AI Instructions feature served via the MCP server. Attackers poison unsanitized instructions to exfiltrate credentials from environment files and delete files on victim machines when the agent makes routine documentation requests. C...
CVE-2026-75130 Context7 2.1.2 Prompt Injection via Custom AI Instructions
Context7 through 2.1.2 contains a prompt injection vulnerability that allows attackers to execute malicious instructions in connected AI coding agents by injecting unsanitized content through the Custom AI Instructions feature served via the MCP server. Attackers can poison the custom instruction...
CVE-2026-74044 Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello
Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a...
EUVD-2026-61076
Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a...
CVE-2026-74044
Wazuh versions 4.0.0 through 4.14.5 are vulnerable: an authenticated cluster peer with a valid Fernet key can supply a path-traversal-shaped node name in the cluster hello payload; on disconnect, the master's peer cleanup routine deletes arbitrary directory contents within the wazuh user's writab...
CVE-2026-74044 Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello
Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a...
CVE-2026-49225
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor. The admin/controller/product/revisions.php...
CVE-2026-49228
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The admin/controller/product/products.php controller accepts a...
WordPress WP Photo Album Plus plugin < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal vulnerability
Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Photo Album Plus versions 9.2.07.002...
EUVD-2026-61038
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author. The admin/controller/content/revisions.php controll...
CVE-2026-49228
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The admin/controller/product/products.php controller accepts a...
CVE-2026-49228 Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' products
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The admin/controller/product/products.php controller accepts a...
CVE-2026-49226
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filteradminid to...
CVE-2026-49226
Vvveb's admin/controller/content/posts.php lets low-privileged Authors override admin_id filters and supply caller-controlled post_id values for duplicate/delete actions, while admin/sql/sqlite/post.sql inconsistently enforces post.admin_id. This enables cross-author post viewing, duplication, de...
CVE-2026-49226 Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors' posts
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filteradminid to...
CVE-2026-73356
Unauthenticated Arbitrary Content Deletion in Breeze = 2.5.12 versions...
CVE-2026-50138 goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when goshs is launched with WebDAV enabled -w, the mode-restriction flags --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port. The WebDAV port is wired straight to golang.org/x/net/webdav.Handler...
GO-2026-6241 Terragrunt: Arbitrary File Deletion via Malicious Module Manifest in github.com/gruntwork-io/terragrunt
Terragrunt: Arbitrary File Deletion via Malicious Module Manifest in github.com/gruntwork-io/terragrunt...