📄 Telenia Software TVox 26.5.3 Command Injection

Telenia Software TVox versions 26.5.3 and below suffer from a command injection vulnerability in actionaudio.php. ------------------------------------------------------------------------------------- Telenia Software TVox = 26.5.3 actionaudio.php OS Command Injection Vulnerability...

PT-2026-67494

Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to invoke predefined component validation...

CVE-2026-52521

A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary SQL commands via the id parameter in the CommentBat feature...

CVE-2026-67673

A stack-based buffer overflow vulnerability exists in the cmdedl function of OreSat Firmware v1.0. The vulnerability is triggered when processing the edl fwflash command, where the argument is copied to a 64-byte stack buffer via memcpy without proper length validation. An attacker with physical...

EUVD-2026-52479

The Ref::SignalGen component of fprime framework v4.2.2 does not validate the safety of user-controlled parameters, allowing attackers to cause a Denial of Service DoS via inputting unsafe parameters...

PT-2026-67495

Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization wa...

CVE-2026-65321 PyAthena SQL Injection via DefaultParameterFormatter DELETE/CTAS

PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format, which routes DELETE and CTAS statements to the escapehive function that backslash-escapes single...

CVE-2026-65321 PyAthena SQL Injection via DefaultParameterFormatter DELETE/CTAS

PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format, which routes DELETE and CTAS statements to the escapehive function that backslash-escapes single...

CVE-2026-12231

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exadinfoboximage’ parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-14920 AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter

Summary...

CVE-2026-14920

CVE-2026-14920 affects AcyMailing

CVE-2026-18352

The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...

CVE-2025-71404

better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting XSS vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a...

EUVD-2025-210583

better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting XSS vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a...

CVE-2025-71404

Summary: CVE-2025-71404 affects better-auth versions after 0.0.2 and before 1.1.16. The vulnerability is a reflected XSS on the /api/auth/error page where the URL parameter error is echoed into HTML without proper neutralization, enabling arbitrary JavaScript when a user visits a crafted link. Im...

CVE-2026-67335

Affected software: better-auth before 1.6.2. Vulnerability: OAuth state validation failure due to cookie-backed state storage without PKCE, allowing attackers to forge the state and supply an attacker-controlled authorization code. Impact: can create authenticated sessions bound to the attacker's...

CVE-2025-71404

better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting XSS vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a...

CVE-2025-71404 better-auth before 1.1.16 Reflected XSS via error parameter

better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting XSS vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a...

CVE-2025-71404 better-auth before 1.1.16 Reflected XSS via error parameter

better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting XSS vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a...

CVE-2026-18344

The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in versions up to, and excluding, 1.1.53. This is due to insufficient input sanitization and output escaping in the responsivethumbnailimagemanagement function, which...