295375 matches found
Apache Struts2 JSON Deserialization Memory Exhaustion / Denial of Service
Apache Struts2's JSON plugin is reportedly susceptible to denial of service attacks through excessive memory allocation during deserialization of deeply nested JSON arrays. Despite the introduction of input length, nesting depth, and element count restrictions in WW-5618 and S2-072, the parser...
Apache Struts2 JSON Deserialization Denial of Service Hardening Bypass
Apache Struts2's JSON plugin is reportedly susceptible to denial of service conditions due to insufficient resource consumption controls during recursive JSON deserialization. Despite the introduction of depth, element count, and input length restrictions through WW-5618 and S2-072, the...
Canva ortto cross-site scripting vulnerability
Versions of Canva Ortto prior to 1.0.25 contain a cross-site scripting vulnerability. This flaw stems from the lack of escaping of settings stored on the administration page, potentially enabling stored cross-site scripting attacks. Attackers can modify plugin configurations and execute arbitrary...
CVE-2026-80067: Stylemix MasterStudy LMS WordPress Plugin: MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated…
MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stmlmsstep parameter passed to the stmlmsimportsampledata AJAX action,...
CVE-2026-113409: canva ortto: The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to…
The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted...
Apache Struts 2 REST Plugin 7.4.0 Chunked Request Body Handling
Apache Struts 2 REST Plugin version 7.4.0 and below skips request-body deserialization and maximum-length enforcement when requests use chunked transfer encoding without a Content-Length header...
CVE-2026-96767: webaways NEX-Forms – Ultimate Forms Plugin for WordPress: The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting…
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 9.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...
CVE-2026-103693: Unknown: The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an…
The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to...
GHSA-W658-MH9P-WW8F Backstage catalog rules can be bypassed for URL locations using encoded path segments
Summary @backstage/plugin-catalog-backend matches URL-type locations against catalog.rules location patterns using the raw URL string submitted by the user, while URL readers resolve that same string in canonical form when fetching the location's content. A URL can therefore be crafted so that it...
@backstage/backend-dynamic-feature-service (>=0.8.8-next.0, <=0.8.8-next.1), @backstage/plugin-catalog-backend-module-incremental-ingestion (>=0.9.0-next.0, <=0.9.0-next.1) +2 more potentially affected by CVE-2026-115923 via @backstage/plugin-catalog-backend (>=4.0.1-next.0, <=4.0.1-next.1)
@backstage/plugin-catalog-backend NPM version =4.0.1-next.0, =0.8.8-next.0, =0.9.0-next.0, =0.1.27-next.0, =0.1.5-next.0, =0.1.5-next.1 Source cves: CVE-2026-115923 Source advisory: OSV:GHSA-W658-MH9P-WW8F...
@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.8.7-next.1), @backstage/plugin-catalog-backend-module-github (>=0.10.1-next.1, <=0.11.1-next.1) +4 more potentially affected by CVE-2026-115923 via @backstage/plugin-catalog-backend (>=3.0.0-next.0, <=3.9.2-next.0)
@backstage/plugin-catalog-backend NPM version =3.0.0-next.0, =0.0.0-nightly-20251122024148, =0.10.1-next.1, =0.3.12-next.1, =0.0.0-nightly-20251123025211, =0.1.12-next.1, =0.1.0-next.0, =0.1.4-next.0 Source cves: CVE-2026-115923 Source advisory: OSV:GHSA-W658-MH9P-WW8F...
@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20251122024148, <=0.8.7-next.1), @backstage/plugin-catalog-backend-module-github (>=0.10.1-next.1, <=0.11.1-next.1) +4 more potentially affected by CVE-2026-115923 via @backstage/plugin-catalog-backend (>=3.0.0-next.0, <=3.9.2-next.0)
@backstage/plugin-catalog-backend NPM version =3.0.0-next.0, =0.0.0-nightly-20251122024148, =0.10.1-next.1, =0.3.12-next.1, =0.0.0-nightly-20251123025211, =0.1.12-next.1, =0.1.0-next.0, =0.1.4-next.0 Source cves: CVE-2026-115923 Source advisory: GHSA-W658-MH9P-WW8F...
Backstage catalog rules can be bypassed for URL locations using encoded path segments
Summary @backstage/plugin-catalog-backend matches URL-type locations against catalog.rules location patterns using the raw URL string submitted by the user, while URL readers resolve that same string in canonical form when fetching the location's content. A URL can therefore be crafted so that it...
@backstage/backend-dynamic-feature-service (>=0.8.8-next.0, <=0.8.8-next.1), @backstage/plugin-catalog-backend-module-incremental-ingestion (>=0.9.0-next.0, <=0.9.0-next.1) +2 more potentially affected by CVE-2026-115923 via @backstage/plugin-catalog-backend (>=4.0.1-next.0, <=4.0.1-next.1)
@backstage/plugin-catalog-backend NPM version =4.0.1-next.0, =0.8.8-next.0, =0.9.0-next.0, =0.1.27-next.0, =0.1.5-next.0, =0.1.5-next.1 Source cves: CVE-2026-115923 Source advisory: GHSA-W658-MH9P-WW8F...
CVE-2026-93851
Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an authenticated user who can post in a channel visible to a system administrator to cause the administrator's browser to send...
CVE-2026-93851
Mattermost versions 11.9.x <= 11.9.1 , 11.8.x <= 11.8.5 , and 11.7.x
CVE-2026-93851 Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post
Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an authenticated user who can post in a channel visible to a system administrator to cause the administrator's browser to send...
CVE-2026-93851 Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post
Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an authenticated user who can post in a channel visible to a system administrator to cause the administrator's browser to send...
CVE-2026-93851
Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an authenticated user who can post in a channel visible to a system administrator to cause the administrator's browser to send...
edx-oauth2-wordpress-backend (>=1.0.0, <=1.0.4), richie (>=2.13.0, <=2.14.1) +2 more potentially affected by CVE-2026-115910 via social-auth-core (4.2.0)
social-auth-core PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - edx-oauth2-wordpress-backend =1.0.0, =2.13.0, =14.0.0, =4.11.0, =4.12.2 Source cves: CVE-2026-115910 Source advisory:...