CVE-2026-84823 Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role

A flaw was found in WildFly. A user with the Monitor role, which is the lowest standard Role-Based Access Control RBAC role, can exploit a path traversal vulnerability in the take-snapshot operation. By manipulating the name parameter, this user can write a copy of the server configuration to an...

CVE-2026-84823

A flaw was found in WildFly. A user with the Monitor role, which is the lowest standard Role-Based Access Control RBAC role, can exploit a path traversal vulnerability in the take-snapshot operation. By manipulating the name parameter, this user can write a copy of the server configuration to an...

GHSA-QJPP-GFFX-2WM9 Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant

Summary A single low-privilege RoleMember can take the entire Nezha dashboard offline, and with it every tenant's web UI, REST API, and agent connections, by racing two ordinary operations on their own service. The crash is a nil pointer dereference in the service-monitor worker at...

Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant

Summary A single low-privilege RoleMember can take the entire Nezha dashboard offline, and with it every tenant's web UI, REST API, and agent connections, by racing two ordinary operations on their own service. The crash is a nil pointer dereference in the service-monitor worker at...

CVE-2026-110375

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This issue affects Download Monitor: from n/a through 5.3.3...

CVE-2026-111216

Netgate pfSense CE through version 2.9.0 is vulnerable to an OS command injection vulnerability. Authenticated users with gateway edit privileges can execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. The root cause is that the start_dpinger() function ...

CVE-2026-110375 WordPress Download Monitor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This issue affects Download Monitor: from n/a through 5.3.3...

CVE-2026-110375

The WordPress Download Monitor plugin (versions

EUVD-2026-102248

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This issue affects Download Monitor: from n/a through 5.3.3...

WordPress Download Monitor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin Download Monitor versions = 5.3.3...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerability has been resolved: Wifi: iwlwifi: pcie: Fixed an integer overflow in the iwlwritetouserbuf function. An integer overflow occurs in the iwlwritetouserbuf function, which is called by the iwldbgfsmonitordataread function. The function is as follows: ...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: tipc: Fixed NULL pointer dereferencing in tipcmonreinitself syzbot reported: tipc: The node number was set to 1055423674 Oops: General protection fault, likely due to a non-canonical address 0xdffffc0000000000: 0000 1 SMP KASA...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fixed a system hang that occurred during resume with a Thunderbolt monitor. Why This issue arises when using a Thunderbolt monitor and performing suspend or resume operations. During the resume procedure, the TBT...

Astra Linux – Vulnerability in Intel Microcode

In some IntelR processors, the incorrect order of behavior during the transition between the executive monitor and the SMI transfer monitor STM may allow a privileged user to potentially enable privilege escalation through local access...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: mt76: mt76x02 – Do not emit warnings for invalid RX descriptor lengths. The MPDU length in the RX descriptor comes from the hardware. In monitor mode with the fcsfail filter enabled, the hardware passes corrupted frames...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use arrayindexnospec with indices that come from the guest. min and destid are guest-controlled indices. Using arrayindexnospec after the bounds checks helps to mitigate speculative execution side-channels...

CVE-2018-15877-RCE

CVE-2018-15877-RCE RCE via the Planview Activity Monitor plugin for wordpress. Requirements: Python3 Selenium Usage: ./exploit.py...

CVE-2020-23934

CVE-2020-23934 References 1 https://www.exploit-db.com/exploits/48636 2 https://github.com/vj0shii/PRTG-Network-MonitorCMS-Authenticated-Remote-Code-Execution/blob/master/PRTGCMS.py 3 https://stackoverflow.com/questions/12385179/how-to-send-a-multipart-form-data-with-requests-in-python 4...

SUSE CVE-2026-93294

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity unintended proxy. The impact is bounded by the Azure role granted to that identity...

PT-2026-115335

Name of the Vulnerable Software and Affected Versions WildFly affected versions not specified Description A path traversal flaw exists in the take-snapshot operation. A user assigned the Monitor role, the lowest standard Role-Based Access Control RBAC role, can manipulate the name parameter to...