295340 matches found
CVE-2026-120322
A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated remotely. The exploit is publicly availab...
EUVD-2026-114924
A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated remotely. The exploit is publicly availab...
CVE-2026-120322 Termix-SSH Termix transferToHost path traversal
A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated remotely. The exploit is publicly availab...
CVE-2026-111487
An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module...
CVE-2026-120597: Welcart e-Commerce Plugin: A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress
A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTTMAIN::errorpagemessage of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched...
CVE-2026-120322: Termix-SSH Termix: A vulnerability was identified in Termix-SSH Termix up to 2.9.2
A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated remotely. The exploit is publicly availab...
Debian dla-4879 : charon-cmd - security update
The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4879 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4879-1 [email protected]...
PT-2026-135254
A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated remotely. The exploit is publicly availab...
CVE-2026-117518: @fastify/reply-from: @fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server
@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server. In versions up to and including 12.8.0, the plugin validated proxy paths against forward-slash dot-segments only and then built the target with the WHATWG URL parser, which normalizes a backslash and its...
PT-2026-135829
Name of the Vulnerable Software and Affected Versions Welcart e-Commerce Plugin versions prior to 2.12.7 Description An issue exists in the ESCOTT MAIN::error page message function within the classes/paymentESCOTT.main.class.php file. Improper handling of the ResponseCd argument allows for...
CVE-2026-103310: Unknown PayHere Payment Gateway: The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment…
The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without...
Linux Distros Unpatched Vulnerability : CVE-2026-104062
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to...
CVE-2026-111813
A flaw was found in Apache Traffic Server. When the experimental magick plugin is enabled without argument signing, an unauthenticated remote attacker can control command-line parameters passed to the underlying ImageMagick conversion utility. An attacker could exploit this argument injection fla...
CVE-2026-111811
A flaw was found in Apache Traffic Server. When the experimental tsmemcache plugin is enabled, it fails to enforce authentication on incoming network connections. An unauthenticated remote attacker can exploit this flaw to inspect, modify, or delete entries in the shared proxy cache, leading to...
Malicious code in atlassian-wallboard-plugin (npm)
Source: ossf-package-analysis 65fa335403aab4ce396a9df1a2b0d61634f51ee8d63db761c0ccf21f744b6292 The OpenSSF Package Analysis project identified 'atlassian-wallboard-plugin' @ 10.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...
Malicious code in atlassian-wallboard-plugin (npm)
[email protected] uses an Atlassian internal-looking name with a high version number and has no code; its package.json declares the dependency node-ac2 as a tarball from the GitHub repository GamerD11/pingtest, which in turn pulls node-ac3 from the same repository. On npm install,...
MAL-2026-18437 Malicious code in atlassian-wallboard-plugin (npm)
[email protected] uses an Atlassian internal-looking name with a high version number and has no code; its package.json declares the dependency node-ac2 as a tarball from the GitHub repository GamerD11/pingtest, which in turn pulls node-ac3 from the same repository. On npm install,...
CVE-2024-11972-POC
Description Name : CVE-2024-11972 CVSSv3 Score : 9.8 Affected Versions : Hunk Companion argparse, requests, urljoin Usage options: -h, --help show this help message and exit -u URL, --url URL Base URL of the WordPress site default: http://localhost/wordpress/. -p PLUGIN, --plugin PLUGIN Plugin na...
CVE-2025-12030
CVE-2025-12030: Insecure Direct Object Reference in ACF to REST API WordPress Plugin Keywords: CVE-2025-12030, ACF to REST API vulnerability, IDOR, WordPress security, authenticated exploit, WordPress plugin vulnerability, CWE-639, ACF field modification, authorization bypass, WordPress CVE 2025,...