108895 matches found
CVE-2026-73846
The CVE describes a vulnerability in CKAN MCP Server prior to version 0.4.112 where canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters. This causes different logical parameter sets used by buildCacheKey to coll...
CVE-2026-73846 CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide an...
CVE-2026-19836 Webkul Bagisto Backend Customer Detail Feature view authorization
A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of the component Backend Customer Detail Feature. Performing a manipulation of the argument ID results in authorization bypass. The attack may ...
CVE-2026-19836
CVE-2026-19836 affects Webkul Bagisto (up to version 2.4.4). The vulnerability lies in the Backend Customer Detail Feature, specifically the /admin/customers/view endpoint, where manipulating the ID parameter can bypass authorization. The issue can be exploited remotely and an exploit has been re...
EUVD-2026-58682
A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of the component Backend Customer Detail Feature. Performing a manipulation of the argument ID results in authorization bypass. The attack may ...
CVE-2026-73556
A flaw was found in vLLM, an inference and serving engine for large language models. An unauthenticated remote attacker can exploit a Regular Expression Denial of Service ReDoS vulnerability in the lm-format-enforcer backend. By submitting a specially crafted regular expression through the...
WordPress Wishlist Member X plugin <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter vulnerability
Unauthenticated Account Takeover via 'mergewith' Parameter vulnerability discovered by bashu - VN in WordPress Plugin WishList Member X versions = 3.34.1...
WordPress affiliate-toolkit plugin <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter vulnerability
Authenticated Administrator+ SQL Injection via 'orderby' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin affiliate-toolkit versions = 3.8.8...
Expression Language (SpEL) Injection
Spring Data MongoDB is vulnerable to Expression Language SpEL Injection. The vulnerability is due to improper handling of user-supplied values during parameter binding in @Query repository methods using a capture-all placeholder, which allows an attacker to inject and execute malicious SpEL...
CVE-2026-12743
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-12743 affiliate-toolkit <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-12743
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-12743
Technical details are not publicly available in the provided documents. Monitor for updates.
EUVD-2026-58590
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-12743 affiliate-toolkit <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-19764
A vulnerability was identified in Raisecom Communication Command and Dispatch Management Platform up to 7.6.5. This affects an unknown part of the file /app/users/getpwd.php. Such manipulation of the argument sip leads to sql injection. The attack can be executed remotely. The exploit is publicly...
CVE-2026-19767
A weakness has been identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file viewdoctortimings.php. Executing a manipulation of the argument delid can lead to sql injection. The attack may be performed from remote. The exploit has been made...
CVE-2026-19767 itsourcecode Hospital Management System viewdoctortimings.php sql injection
A weakness has been identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file viewdoctortimings.php. Executing a manipulation of the argument delid can lead to sql injection. The attack may be performed from remote. The exploit has been made...
CVE-2026-19767 itsourcecode Hospital Management System viewdoctortimings.php sql injection
A weakness has been identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file viewdoctortimings.php. Executing a manipulation of the argument delid can lead to sql injection. The attack may be performed from remote. The exploit has been made...
EUVD-2026-58562
A weakness has been identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file viewdoctortimings.php. Executing a manipulation of the argument delid can lead to sql injection. The attack may be performed from remote. The exploit has been made...