CVE-2026-106032 Server-side request forgery and local file read via unrestricted external OpenAPI reference resolution in Bedrock AgentCore Starter Toolkit agent import

Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environment of a user importing a Bedrock Agent to issue arbitrar...

EUVD-2026-94001

Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values...

CVE-2026-105812

The Amazon Bedrock AgentCore Starter Toolkit before version 0.3.14 is vulnerable to a code injection flaw (CWE-94) within its agent import functionality. The root cause is the lack of safe literal encoding for configuration values when generating Python source code. An authenticated same-account ...

CVE-2026-83550

A flaw was found in postgres-exporter. Due to the blank import of net/http/pprof, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process...

CVE-2021-46364

CVE-2021-46364: Deserialización de YAML en Magnolia CMS Magnolia versiones =6.2.3 tiene un analizador Snake YAML que es vulnerable a ataques de deserialización que pueden permitir a un atacante invocar constructores arbitrarios de Java al importar archivos YAML. Se ha logrado ejecución remota de...

CVE-2026-105844

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended applicatio...

CVE-2026-45806

CVE-2026-45806 La importación remota de imágenes de Penpot permitía que un editor de archivos autenticado convirtiera una función de medios normal en SSRF de origen de backend porque las URL controladas por el atacante cruzaban hacia una ruta de búsqueda del servidor que seguía redirecciones sin...

GHSA-QF28-8HC6-VWRP Payload: Prototype pollution in Payload Import Export plugin

Impact An unauthenticated user could cause unintended application behavior when the Import Export plugin is enabled, allowing an attacker to submit and execute remote code RCE. Applications that do not use @payloadcms/plugin-import-export are not affected. Patches Users should upgrade Payload...

Payload: Prototype pollution in Payload Import Export plugin

Impact An unauthenticated user could cause unintended application behavior when the Import Export plugin is enabled, allowing an attacker to submit and execute remote code RCE. Applications that do not use @payloadcms/plugin-import-export are not affected. Patches Users should upgrade Payload...

CVE-2026-105844 Payload: Prototype pollution in Payload Import Export plugin

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended applicatio...

EUVD-2026-93470

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended applicatio...

CVE-2026-105844

Payload , a headless content management system, contains a prototype pollution vulnerability in the @payloadcms/plugin-import-export plugin. An unauthenticated user can submit prototype-sensitive field paths, leading to unintended application behavior and potential remote code execution (RCE) . T...

CVE-2026-105844 Payload: Prototype pollution in Payload Import Export plugin

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended applicatio...

CVEs

CVE-2022-2992: Ejecución remota de comandos mediante importación de Github Información Descripción: Esto permite a un usuario autenticado lograr la ejecución remota de código a través del endpoint de la API Import from GitHub. Versiones afectadas: todas las versiones desde 11.10 anteriores a...

CVE-2026-104069 HortusFox < 6.2 Remote Code Execution via Theme Import

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafte...

CVE-2026-39778

Unauthenticated Cross Site Scripting XSS in Ansar Import – One Click Starter Sites – for Elementor & Themes = 2.1.2 versions...

CVE-2026-104757

Editor Privilege Escalation in Import and export users and customers = 2.5.5 versions...

CVE-2026-104757

The WordPress Import and export users and customers plugin (versions

CVE-2026-104757 WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerability

Editor Privilege Escalation in Import and export users and customers = 2.5.5 versions...

CVE-2026-104757 WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerability

Editor Privilege Escalation in Import and export users and customers = 2.5.5 versions...