332292 matches found
CVE-2026-84656
A missing Item/Read permission check in an HTTP endpoint of Jenkins 2.579 and earlier (and LTS 2.568.2 and earlier ) allows an attacker with Item/Read permission on at least one job to read build parameter names and values of other jobs they should not have access to. This is tracked as SECURITY-...
CVE-2026-84656
A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to...
K000163148: Linux kernel vulnerability CVE-2026-63810
Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: block: Avoid mounting the bdev pseudo-filesystem in userspace The bdev pseudo-filesystem is an internal kernel filesystem with which userspace should not interfere. Unregister it so that userspace...
CVE-2026-82955
In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disablejwksecurity parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting...
CVE-2026-81571
The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shortcode engine, allowing unauthenticated attackers to have arbitrary shortcodes registered on the site executed server-side...
CVE-2026-2688
The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints...
Sulu: Stored XSS via media download inline-disposition override
Impact Stored Cross Site Scripting XSS in the media download endpoint. The download route /media/id/download/slug and its admin variant accepts the query parameter ?inline=1. When it is present, the response is sent with the header Content-Disposition: inline for any MIME type, which overrides th...
GHSA-PP4X-CCXQ-6R33 Sulu: Stored XSS via media download inline-disposition override
Impact Stored Cross Site Scripting XSS in the media download endpoint. The download route /media/id/download/slug and its admin variant accepts the query parameter ?inline=1. When it is present, the response is sent with the header Content-Disposition: inline for any MIME type, which overrides th...
Attackers Actively Exploiting Critical Vulnerability in Elementor Pro Plugin
On August 19th, 2026, we publicly disclosed a critical Unauthenticated Arbitrary File Upload vulnerability in Elementor Pro, a WordPress plugin with more than 6,000,000 active installations. This vulnerability can be leveraged by unauthenticated attackers to upload arbitrary files, including...
NPM: Orval: Import-time RCE via query-parameter default -> zod module-level template literal
NPM: Orval: Import-time RCE via query-parameter default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...
Orval: Import-time RCE via query-parameter default -> zod module-level template literal
Summary Orval's zod schema generation emits the query-parameter default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...
EUVD-2026-62600
Orval: Import-time RCE via query-parameter default - zod module-level template literal...
GHSA-P4CG-3328-RVFG Orval: Import-time RCE via query-parameter default -> zod module-level template literal
Summary Orval's zod schema generation emits the query-parameter default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...
BIT-MYSQL-CLIENT-2026-55855 MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js permits SQL injection when attacker-controlled Buffer parameters are escaped client-side under the big5, gbk, sjis,...
GHSA-X5FP-WJ9C-MXMX qs array-limit bypass via bracket-key comma parsing
Summary qs v6.15.3 allows bracket-key input to bypass arrayLimit and throwOnLimitExceeded when comma: true. The input a=1,2,3,4 succeeds with arrayLimit: 3, while the equivalent plain-key input is rejected. Affected version tested: text qs v6.15.3 commit 18d085e919dae70c8f1b200ab99323058edab2c2...
qs array-limit bypass via bracket-key comma parsing
Summary qs v6.15.3 allows bracket-key input to bypass arrayLimit and throwOnLimitExceeded when comma: true. The input a=1,2,3,4 succeeds with arrayLimit: 3, while the equivalent plain-key input is rejected. Affected version tested: text qs v6.15.3 commit 18d085e919dae70c8f1b200ab99323058edab2c2...
BIT-MARIADB-MIN-2026-55855 MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js permits SQL injection when attacker-controlled Buffer parameters are escaped client-side under the big5, gbk, sjis,...
BIT-MARIADB-2026-55855 MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js permits SQL injection when attacker-controlled Buffer parameters are escaped client-side under the big5, gbk, sjis,...
EUVD-2026-70056
In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disablejwksecurity parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting...
CVE-2026-82955
In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gateway component had the disablejwksecurity parameter hard-coded to true, with no option to override it through the Helm chart configuration. This setting...