110 matches found
CVE-2026-16069
CVE-2026-16069 affects the Brizy WordPress plugin (pre-2.8.19). The vulnerability stems from unsanitized/uncached featured-image focal-point coordinates submitted via an AJAX action, which are stored and later echoed into HTML attributes in the post editor’s Featured Image meta box. This enables ...
CVE-2026-33161
Craft CMS is a content management system CMS. From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-privileged authenticated user can call assets/image-editor with the ID of a private asset they cannot view and still receive editor response dat...
CVE-2026-33161
Craft CMS is a content management system CMS. From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-privileged authenticated user can call assets/image-editor with the ID of a private asset they cannot view and still receive editor response dat...
CVE-2026-33161 Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users
Craft CMS is a content management system CMS. From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-privileged authenticated user can call assets/image-editor with the ID of a private asset they cannot view and still receive editor response dat...
Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users
Summary A low-privileged authenticated user can call assets/image-editor with the ID of a private asset they cannot view and still receive editor response data, including focalPoint. The endpoint returns private editing metadata without per-asset authorization validation. Root-cause analysis: 1...
GHSA-VGJG-248P-RFM2 Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users
Summary A low-privileged authenticated user can call assets/image-editor with the ID of a private asset they cannot view and still receive editor response data, including focalPoint. The endpoint returns private editing metadata without per-asset authorization validation. Root-cause analysis: 1...
EUVD-2014-0870
Malware in sbrugna...
EUVD-2013-5238
Malware in sbrugna...
EUVD-2014-0873
Malware in sbrugna...
EUVD-2014-0872
Malware in sbrugna...
EUVD-2014-0869
Malware in sbrugna...
EUVD-2013-5237
Malware in sbrugna...
EUVD-2014-0871
Malware in sbrugna...
EUVD-2014-0883
Malware in sbrugna...
EUVD-2020-8188
Malware in sbrugna...
EUVD-2013-2964
Malware in sbrugna...
EUVD-2025-16748
Malicious code in bioql PyPI...
EUVD-2025-16747
Malicious code in bioql PyPI...