CVE-2022-31044

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. The Key Storage converter plugin mechanism was not enabled correctly in Rundeck 4.2.0 and 4.2.1, resulting in use of the encryption layer for Key Storage possibly not working. Any credentials created...

CVE-2022-31028

MinIO is a multi-cloud object storage solution. Starting with version RELEASE.2019-09-25T18-25-51Z and ending with version RELEASE.2022-06-02T02-11-04Z, MinIO is vulnerable to an unending go-routine buildup while keeping connections established due to HTTP clients not closing the connections...

CVE-2022-0247

An issue exists in Fuchsia where VMO data can be modified through access to copy-on-write snapshots. A local attacker could modify objects in the VMO that they do not have permission to. We recommend upgrading past commit d97c05d2301799ed585620a9c5c739d36e7b5d3d or any of the listed versions...

CVE-2022-35919

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users authorized for admin:ServerUpdate can selectively trigger an error that in response, returns the content of the path requested. Any normal OS system would allow...

CVE-2024-34073

sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. In affected versions the capturedependencies function in sagemaker.serve.saveretrive.version100.save.utils module allows for potentially unsafe Operating System OS Command Injection if...

PT-2026-1712

Name of the Vulnerable Software and Affected Versions WP Table Builder – Drag & Drop Table Builder plugin for WordPress versions up to and including 2.0.19 Description The WP Table Builder – Drag & Drop Table Builder plugin for WordPress has a flaw where data can be modified without proper...

PT-2026-1726

Name of the Vulnerable Software and Affected Versions The Tooltip plugin for WordPress versions up to and including 1.0.2 Description The Tooltip plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'the tooltip' shortcode. Insufficient input sanitization and output...

PT-2026-1707

Name of the Vulnerable Software and Affected Versions Shabat Keeper versions up to and including 0.4.4 Description The Shabat Keeper plugin for WordPress is susceptible to Reflected Cross-Site Scripting due to inadequate input sanitization and output escaping. This allows unauthenticated attacker...

PT-2026-1749

Name of the Vulnerable Software and Affected Versions Eventin – Event Manager, Events Calendar, Event Tickets and Registrations plugin for WordPress versions up to and including 4.0.51 Description The Eventin plugin for WordPress is susceptible to unauthorized data modification because of a missi...

PT-2026-3410

Summary Since 2017, the default webpack plugins have passed the entire process.env to EnvironmentPlugin. This pattern exposed ALL build environment variables to client-side JavaScript bundles whenever application code or any dependency referenced process.env.VARIABLE NAME. This is not a regressio...

PT-2026-1736

Name of the Vulnerable Software and Affected Versions sizam REHub Framework versions through 19.9.5 Description A missing authorization issue exists in the REHub Framework. This allows access to functionality that is not properly constrained by Access Control Lists ACLs. Recommendations Update to...

PT-2026-2256

Name of the Vulnerable Software and Affected Versions Mediawiki - Wikibase Extension versions 1.39 through 1.45 Description The Mediawiki - Wikibase Extension is susceptible to a Cross-Site Scripting XSS issue due to improper neutralization of input during web page generation. This allows for the...

PT-2026-1927

Name of the Vulnerable Software and Affected Versions Pinpoll versions through 4.0.0 Description The software contains a flaw related to improper input handling during web page creation, specifically a Reflected Cross-site Scripting XSS issue. This allows for the injection of malicious scripts in...

PT-2026-1785

Name of the Vulnerable Software and Affected Versions ThemeMove Moody tm-moody versions through 2.7.3 Description The software contains a flaw related to improper control of filename for include/require statements, specifically a PHP Local File Inclusion issue. This allows for the inclusion of...

PT-2026-2110

Name of the Vulnerable Software and Affected Versions NiceGUI versions 2.13.0 through 3.4.1 Description NiceGUI is a Python-based UI framework susceptible to a cross-site scripting XSS issue. The issue arises when developers provide attacker-controlled strings to the ui.navigate.history.push or...

PT-2026-1906

Name of the Vulnerable Software and Affected Versions AITpro BulletProof Security versions n/a through 6.9 Description A flaw exists in AITpro BulletProof Security that allows retrieval of embedded sensitive data due to insertion of sensitive information into sent data. Recommendations Update...

PT-2026-2112

Name of the Vulnerable Software and Affected Versions NiceGUI versions 2.22.0 through 3.4.1 Description NiceGUI is a Python-based UI framework. An unsafe implementation in the pushstate event listener used by ui.sub pages allows an attacker to manipulate the fragment identifier of the URL, even...

PT-2026-1684

Name of the Vulnerable Software and Affected Versions WP Cost Estimation versions prior to 9.660 Description The WP Cost Estimation plugin for WordPress is susceptible to a directory traversal issue in versions before 9.660. This flaw resides within the uploadFormFiles function and permits...

CVE-2025-1642

A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been declared as critical. This vulnerability affects unknown code of the file /AGE0000700/GetImageMedico?fooId=1. The manipulation of the argument fooId leads to improper control of resource identifiers. The attack can be initiat...

CVE-2024-2828

A vulnerability, which was classified as critical, was found in lakernote EasyAdmin up to 20240315. Affected is the function thumbnail of the file src/main/java/com/laker/admin/module/sys/controller/IndexController.java. The manipulation of the argument url leads to server-side request forgery. I...