Hanwha Vision Cameras Missing Authentication for Critical Function (CVE-2024-54013)

Penetration Testing engineers at Amazon have identified a security flaw related to request handling in the web server component that could, under certain conditions, lead to unintended access to protected functions. The manufacturer has released patch firmware for the flaw, please refer to the...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

No d...

PT-2026-67332

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.30.0 Description A heap-based buffer overflow exists in the Windows clipboard client's CliprdrStream Read function. The issue occurs when an OLE paste consumer calls IStream::Read with a fixed-size buffer of cb byte...

CVE-2026-13339

The CVE-2026-13339 issue concerns the CubeWP Framework WordPress plugin, affected versions are all up to and including 1.1.30. Affected component: cubewp_get_svg_content function, which allows a Directory Traversal. Unauthenticated attackers can read arbitrary server files containing sensitive in...

CVE-2026-67341

ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict...

CVE-2026-67341

ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict...

CVE-2026-67341

ArcadeDB versions before 26.7.2 are affected by an authorization bypass vulnerability in SQL DEFINE FUNCTION ... LANGUAGE js. The issue allows attackers with database access to execute arbitrary JavaScript by submitting DEFINE FUNCTION statements, bypassing scripting controls intended to be admin...

CVE-2026-67341 ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION

ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict...

EUVD-2026-51832

ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict...

CVE-2026-67323

GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive and git.lsremote, allowing command injection via options such as --exec/--upload-pack leading to arbitrary command execution. Additionally, Repo.itercommits and Repo.blame do not check...

CVE-2026-67321

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in ''. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a...

CVE-2026-67341 ArcadeDB before 26.7.2 Authorization Bypass via SQL DEFINE FUNCTION

ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict...

React Server Components - Remote Code Execution

React Server Components 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack contain a remote code execution caused by unsafe deserialization of payloads from HTTP requests to Server Function endpoints, letting...

CVE-2026-18062

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Identity Block Inner Image Content in all versions up to, and including, 3.7.8.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-15951

The Icegram Mailer plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in versions up to, and including, 1.0.12. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the...

CVE-2026-6453

The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewpremoverelation AJAX function, specifically the use of wpunslash on the relationid parameter before interpolating it...

EUVD-2026-51755

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the savedata function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callab...

CVE-2026-16144

The CVE-2026-16144 entry concerns Kali Forms ≤ 2.4.20 (WordPress plugin) with unauthenticated Remote Code Execution via the _save_data function. The root cause is insufficient validation of the _save_data() path when a form field value can overwrite a trusted placeholder, allowing attacker-contro...

EUVD-2026-51654

An issue in the parseGoosePayload function /goose/goosereceiver.c of libiec61850 v1.6 allows attackers to bypass authentication via a captured GOOSE frame...

CVE-2026-53551

The vulnerability CVE-2026-53551 affects free5GC AUSF prior to version 1.4.5, where the supiOrSuci field in UE authentication requests is not validated. Null bytes (\x00) and other control characters pass through JSON parsing and are forwarded to the UDM in an unescaped URL path, causing Go’s net...