439794 matches found
CVE-2026-82814 Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection
The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPXUpdateEngine::unserializeTest during migration. This allows unauthenticate...
CVE-2026-114107
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to...
CVE-2026-114089
Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/ mints a Personal Access Token without any consent step. Attackers mint an unauthenticated code, lure a logged-in user to that URL, then...
CVE-2026-114056
ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags without UPDATESCHEMA permission. Attackers can send a bare ALTER TYPE edgeType WITH lightweight = true command over the HTTP, gRPC...
CVE-2026-114059
ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST...
CVE-2026-114038
A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended daemon memory, leading to information disclosure...
CVE-2026-105044
Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform Host Monitoring V3.0 allows an authenticated console administrator to execute arbitrary commands on attached clients via OS command injection...
TOPAZ Metron PTS Time Synchronization Command Injection
The vulnerability of the TOPAZ Metron PTS time synchronization device is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to inject arbitrary OS commands...
GEO.RITM REST API Auth Bypass Info Disclosure
The vulnerability of the software interface REST API of the GEO.RITM software lies in the lack of authentication when accessing the function for retrieving object attributes. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to confidential information...
REDAAM IT-infrastructure Management System Auth Bypass
The vulnerability of the “REDAAM” IT-infrastructure centralized management system is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...
Ascon.Pilot.WinService Auth Bypass Code Execution
The vulnerability of the Ascon.Pilot.WinService component in the Pilot-BIM data management system is related to the lack of authentication for a critical function. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Test IT testing system Command Execution
The vulnerability of the Test IT testing system relates to the use of externally controlled input data for class selection. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...
Platypus.js Auth Bypass Command Execution
The vulnerability of the Platypus.js platform is related to deficiencies in the authentication process. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
FOQUZ Platform Auth Bypass
The vulnerability of the FOQUZ platform is related to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
FOQUZ Platform Auth Bypass
The vulnerability of the FOQUZ platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...
FOQUZ Platform Auth Bypass
The vulnerability of the FOQUZ platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...
FOQUZ Platform Auth Bypass
The vulnerability of the FOQUZ platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...
FOQUZ Platform Auth Bypass
The vulnerability of the FOQUZ platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...
FOQUZ Platform Auth Bypass
The vulnerability of the FOQUZ platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...
CVE-2025-22457
CVE-2025-22457 CVE-2025-22457: Python Exploit POC Scanner to Detect Ivanti Connect Secure RCE This script helps identify Ivanti Connect Secure, Policy Secure, or ZTA Gateways that may be vulnerable to CVE-2025-22457 , a critical unauthenticated stack-based buffer overflow in the web process...