CVE-2026-88997 JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key

The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the...

EUVD-2026-85052

The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the...

CVE-2026-88997

The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the...

EUVD-2026-85044

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an...

CVE-2026-86608 WP Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated DoS via Unbounded User Meta Insertion

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an...

CVE-2026-86608

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an...

CVE-2025-57462

CVE-2025-57462 Des: Stored XSS via Malicious File Upload in machpanel 8.0.32. POC: Navigate to https://controlpaneldomain/Client/SubmitTicket.aspx and Upload PDF file that contain XSS scripts in metadata, after submitting the ticket you can execute malicius XSS script by accessing the uplaoded...

CVE-2025-31324-File-Upload

CVE-2025-31324-File-Upload A totally unauthenticated file-upload endpoint in Visual Composer lets anyone drop arbitrary files e.g., a JSP web-shell onto the server. Proof-of-concept tool to check for and exploit the unauthenticated file upload vulnerability CVE-2025-31324 in SAP NetWeaver Visual...

CVE-2025-31324_PoC_SAP

CVE-2025-31324PoC Proof-of-Concept for CVE-2025-31324: Unauthenticated upload in SAP NetWeaver Visual Composer Metadata Uploader This script performs: 1. File upload to the vulnerable endpoint via Upload host/port 2. Optional trigger via HTTP GET via Trigger host/port 3. Basic response...

CVE-2026-93436

A flaw was found in vLLM. A remote attacker can exploit this vulnerability by submitting specially crafted inference requests that are rejected but still cause the system to retain decode-side metadata. This improper cleanup leads to an unbounded exhaustion of decode-worker memory, resulting in a...

Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses

Summary Cloudreve's server-side request forgery guard ValidateExternalURL pkg/request/ssrf.go resolves a user-supplied URL host and rejects it when any resolved IP is a loopback, private, link-local, multicast, unspecified, CGNAT, or the cloud-metadata address. The classification is performed by...

CVE-2026-85995

The source code editor Notepad++ is vulnerable in versions 8.9.7 through 8.9.8 due to an improper verification of cryptographic signatures . The updater and signature verification path can accept a modified GUP.exe file where the Authenticode digest is invalid, yet the embedded certificate metada...

CVE-2026-85740 LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, validatedaddresses in lightrag/parser/markdown/parser.py evaluates the literal resolved address with ipaddress.isglobal without consistently classifying an IPv4 address embedded in an IPv6 transition wrapper. A call...

CVE-2026-85740

The lightrag-hku (LightRAG) package is vulnerable to Server-Side Request Forgery (SSRF) in versions

CVE-2026-81881

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser was vulnerable because a relative Swift field pointer could be lower than the field-metadata section base, making subtraction produce a negative logical inde...

CVE-2026-79913

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side request forgery guard in pkg/request/ssrf.go passes resolved addresses to checkIP without decoding NAT64, IPv4-compatible, and 6to4 IPv4-in-IPv6 transition forms. An authenticated...

EUVD-2026-84527

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side request forgery guard in pkg/request/ssrf.go passes resolved addresses to checkIP without decoding NAT64, IPv4-compatible, and 6to4 IPv4-in-IPv6 transition forms. An authenticated...

CVE-2026-79913

Cloudreve (self-hosted file management system) has an SSRF guard bypass in the ValidateExternalURL function (pkg/request/ssrf.go) prior to version 4.18.0 . The checkIP validator fails to decode NAT64 , IPv4-compatible , and 6to4 IPv4-in-IPv6 transition address wrappers, causing embedded loopback,...

CVE-2026-81881 radare2: Heap out-of-bounds read in radare2 Mach-O Swift metadata parser

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser was vulnerable because a relative Swift field pointer could be lower than the field-metadata section base, making subtraction produce a negative logical inde...

CVE-2026-81881 radare2: Heap out-of-bounds read in radare2 Mach-O Swift metadata parser

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Mach-O Swift field-metadata parser was vulnerable because a relative Swift field pointer could be lower than the field-metadata section base, making subtraction produce a negative logical inde...