CVE-2026-79571

Incorrect access control in the SellerAuthorizeAspect component of springboot-project v1.0.0 allows unauthenticated attackers to access all seller management interfaces and list all products/orders, put products on/off sale, finish/cancel orders, and modify categories without authentication...

CVE-2026-76931

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

CVE-2026-76931 Zephyr Project Manager <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

EUVD-2026-72696

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

CVE-2026-76931

The Zephyr Project Manager WordPress plugin (all versions up to and including 3.3.205 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'message' parameter , caused by insufficient input sanitization and output escaping. Authenticated attackers with Custom-level access or higher can in...

CVE-2026-76931 Zephyr Project Manager <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

Duplicate Advisory: knowns vulnerable to command injection

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mc52-mwq4-vfx3. This link is maintained to preserve external references. Original Description knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files...

EUVD-2026-72589

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usagerules allows a malicious package publisher to inject terminal control sequences into the output of mix usagerules.searchdocs. mix usagerules.searchdocs searches Hex documentation through...

CVE-2026-82710: Improper Neutralization of Escape, Meta, or Control Sequences

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usagerules allows a malicious package publisher to inject terminal control sequences into the output of mix usagerules.searchdocs. mix usagerules.searchdocs searches Hex documentation through...

CVE-2026-79571

Incorrect access control in the SellerAuthorizeAspect component of springboot-project v1.0.0 allows unauthenticated attackers to access all seller management interfaces and list all products/orders, put products on/off sale, finish/cancel orders, and modify categories without authentication...

PT-2026-87033

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

CVE-2026-79571

Incorrect access control in the SellerAuthorizeAspect component of springboot-project v1.0.0 allows unauthenticated attackers to access all seller management interfaces and list all products/orders, put products on/off sale, finish/cancel orders, and modify categories without authentication...

CVE-2026-79571

The springboot-project v1.0.0 is vulnerable to an incorrect access control flaw in the SellerAuthorizeAspect component. This vulnerability allows unauthenticated attackers to access all seller management interfaces. Impacted actions include listing all products and orders, putting products on or ...

EUVD-2026-72849

Incorrect access control in the SellerAuthorizeAspect component of springboot-project v1.0.0 allows unauthenticated attackers to access all seller management interfaces and list all products/orders, put products on/off sale, finish/cancel orders, and modify categories without authentication...

CVE-2026-79571: Improper Access Control

Incorrect access control in the SellerAuthorizeAspect component of springboot-project v1.0.0 allows unauthenticated attackers to access all seller management interfaces and list all products/orders, put products on/off sale, finish/cancel orders, and modify categories without authentication...

PT-2026-88084

🚨 HIGH: CVE-2026-81821 CVSS 8.4 PIMBoards project files vulnerable to decryption attack. Threat actors with read access can decrypt sensitive data. Patch immediately. CVE Vulnerability ThreatIntel https://t.co/enlHrybEZY...

PT-2026-87100

Incorrect access control in the SellerAuthorizeAspect component of springboot-project v1.0.0 allows unauthenticated attackers to access all seller management interfaces and list all products/orders, put products on/off sale, finish/cancel orders, and modify categories without authentication...

CVE-2026-76931: Improper Neutralization of Input During Web Page Generation

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

CVE-2026-82584

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel an anti-typosquatting safeguard listing a package's hex...

CVE-2026-82584

ash-project igniter (an Elixir build tool) is vulnerable to terminal escape sequence injection in its mix igniter.install confirmation panel. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal...