331963 matches found
secretlint v13.0.5
Secretlint Secretlint is a Pluggable linting tool to prevent committing credentials. Features Scanner : Find credentials in a project and report these Project Friendly: Easy to set up your project and integrate CI services Pre-Commit Hook : Prevent committing credential files Pluggable : Allow...
CVE-2026-14357 DevKit Pro <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' Parameter
The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEVinstallthemesfunc function registered on the wpajaxDPDEVinstallthemes action. This makes it possib...
CVE-2026-14357 DevKit Pro <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' Parameter
The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEVinstallthemesfunc function registered on the wpajaxDPDEVinstallthemes action. This makes it possib...
CVE-2026-9055
The Booking for Appointments and Events Calendar – Amelia Premium plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint, which allows customers to set...
Exploit for CVE-2026-84361
CVE-2026-84361: Composer’s P4PORT command execution PoC Engl...
nah v1.4.0
expensive mistakes stop here a guard that blocks catastrophic agent actions nahguard.ai • what it blocks • how it decides • install • extend • threat model claude code · codex · cursor · pi · + 11 more nah is a guard that sits in your coding agent's hook path and reads tool calls before they run...
Security Bulletin: Multiple vulnerabilities in jackson-databind impact IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent
Summary Multiple vulnerabilities in jackson-databind impact IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION:...
CVE-2026-9055
CVE-2026-9055 affects the Amelia (Premium) booking plugin for WordPress in versions 8.0 through 9.6.2 , rated CVSS 9.8 (Critical) . The root cause is insufficient validation of the attacker-controlled type parameter in the customer update endpoint: when externalId is set to 0, a customer can set ...
EUVD-2026-69832
The Booking for Appointments and Events Calendar – Amelia Premium plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint, which allows customers to set...
CVE-2026-9055 Booking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'
The Booking for Appointments and Events Calendar – Amelia Premium plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint, which allows customers to set...
CVE-2026-9055 Booking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'
The Booking for Appointments and Events Calendar – Amelia Premium plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint, which allows customers to set...
Malicious code in peertube-plugin-poc-marker (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff307f6227ac4a9217a899b419a6931ddfe0376cb0cc6ba3570c0f589247241c index.js runs id; uname -a; hostname; date -u; ls -d /var/www/peertube via execSync when PeerTube invokes the plugin's register hook, then POSTs the...
MAL-2026-15817 Malicious code in peertube-plugin-poc-marker (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff307f6227ac4a9217a899b419a6931ddfe0376cb0cc6ba3570c0f589247241c index.js runs id; uname -a; hostname; date -u; ls -d /var/www/peertube via execSync when PeerTube invokes the plugin's register hook, then POSTs the...
CVE-2026-14982 WP File Download <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter
The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server,...
CVE-2026-14982 WP File Download <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter
The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server,...
Malicious code in eslint-rxjs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2794273ee7e40da4b37c017636209acf1402b1104ab5fc265a43cc7d83228e72 eslint-rxjs is a masquerade package whose npm metadata is internally inconsistent: the name references ESLint/RxJS, the description reads 'Integrate...
MAL-2026-15812 Malicious code in eslint-rxjs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2794273ee7e40da4b37c017636209acf1402b1104ab5fc265a43cc7d83228e72 eslint-rxjs is a masquerade package whose npm metadata is internally inconsistent: the name references ESLint/RxJS, the description reads 'Integrate...
GeoNetwork - Reflected Cross-Site Scripting
GeoNetwork versions 4.4.5 through 4.4.11 are vulnerable to reflected cross-site scripting XSS in the public unauthenticated catalog search functionality. The uiconfig query parameter of the catalog.search endpoint is reflected into a JavaScript context without sufficient sanitization, allowing...
reconftw v5.0.0-beta.1
reconFTW reconFTW is a powerful automated reconnaissance tool designed for security researchers and penetration testers. It streamlines the process of gathering intelligence on a target by performing subdomain enumeration, vulnerability scanning, OSINT and more. With a modular design, extensive...
CVE-2026-84702
facefusion through 3.6.1 fails to normalize job identifiers in getjobfilename, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations...