232025 matches found
MINI-9C36-RV4C-V6VJ
Bulletin has no description...
MINI-9W4V-XFJH-4QCP
Bulletin has no description...
ROOT-APP-NPM-CVE-2022-37599 CVE-2022-37599 in loader-utils - Patched by Root
Root has patched CVE-2022-37599 in the loader-utils package for Root:npm. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2024-38820 CVE-2024-38820 in org.springframework:spring-web - Patched by Root
Root has patched CVE-2024-38820 in the org.springframework:spring-web package for Root:Maven. Multiple fixed versions available...
CVE-2026-72889
Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify. verify resolves the signature method class from the signaturemethod parameter of the incoming message. signaturemethod is required on every request, so the algorithm used to check a signature is...
ROOT-APP-GOBINARY-CVE-2026-46600 CVE-2026-46600 in golang.org/x/net - Patched by Root
Root has patched CVE-2026-46600 in the golang.org/x/net package for Root:Go. Multiple fixed versions available...
CVE-2026-19417
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports...
CVE-2026-15253
The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list view, allowing users with the Author role and above to inject arbitrary web scripts that are executed in the browser of a high...
CVE-2026-19417 KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports...
EUVD-2026-62290
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports...
EUVD-2026-62268
The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list view, allowing users with the Author role and above to inject arbitrary web scripts that are executed in the browser of a high...
CVE-2026-15253
The Easy Media Replace WordPress plugin (≤0.2.0) fails to sanitise attachment titles before rendering them in HTML attributes in the media library list view, enabling Author+ role users to inject stored XSS executed in the browser of higher-privileged admins. No patch version or exploit code is d...
Oliver 5 Library Server <8.00.008.053 - Local File Inclusion
Oliver 5 Library Server versions prior to 8.00.008.053 are vulnerable to local file inclusion via the FileServlet function. id: CVE-2021-45027 info: name: Oliver 5 Library Server 8.00.008.053 - Local File Inclusion author: gy741 severity: high description: Oliver 5 Library Server versions prior t...
WordPress Media Library Assistant <= 3.34 - SQL Injection
David Lingren Media Library Assistant = 3.34 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input. id: CVE-2026-34885 info: name: WordPress Media Library Assistant = 3.34 -...
Slims9 Bulian 9.4.2 - SQL Injection
Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data can be obtained. id: CVE-2021-45793 info: name: Slims9 Bulian 9.4.2 - SQL Injection author: nblirwn severity: high description: | Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data c...
MicroStrategy Library <11.1.3 - Cross-Site Scripting
MicroStrategy Library before 11.1.3 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other...
Php-mod/curl Library <2.3.2 - Cross-Site Scripting
Php-mod/curl library before 2.3.2 contains a cross-site scripting vulnerability via the postfilepathupload.php key parameter and the POST data to postmultidimensional.php. An attacker can inject arbitrary script, which can allow theft of cookie-based authentication credentials and launch of other...
SAS/Internet 9.4 1520 - Local File Inclusion
SAS/Internet 9.4 build 1520 and earlier allows local file inclusion. The samples library included by default in the appstart.sas file, allows end-users of the application to access the sample.webcsf1.sas program, which contains user-controlled macro variables that are passed to the DS2CSF macro...