CVE-2026-78657 SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field

The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesubmissionfiles function in all versions up to, and including, 1.4.11. This makes it possible for unauthenticated attackers to delete arbitra...

CVE-2026-78657 SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field

The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesubmissionfiles function in all versions up to, and including, 1.4.11. This makes it possible for unauthenticated attackers to delete arbitra...

CVE-2026-14357 DevKit Pro <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' Parameter

The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEVinstallthemesfunc function registered on the wpajaxDPDEVinstallthemes action. This makes it possib...

EUVD-2026-69873

The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEVinstallthemesfunc function registered on the wpajaxDPDEVinstallthemes action. This makes it possib...

CVE-2026-14357

The DevKit Pro plugin for WordPress is vulnerable to missing authorization in versions up to and including 2.3.0 . The root cause is a missing capability check and nonce validation in the DPDEV_install_themes_func() function registered on the wp_ajax_DPDEV_install_themes action. This allows authe...

CVE-2026-14357 DevKit Pro <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' Parameter

The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEVinstallthemesfunc function registered on the wpajaxDPDEVinstallthemes action. This makes it possib...

CVE-2026-19754

Baserow 2.3.3 contains a SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The...

heartbleed.js

heartbleed.js 用于 Node.js 的 openssl Heartbleed 漏洞检查 检查结果 root@kitploit: "code":0,"data":"1803021003020ff0d8030253435b909d9b720bbc0cbc2b92a84897cfbd3904cc160a8503909..." code: 0 存在漏洞。 存在漏洞 code: 1 不存在漏洞。 不存在漏洞 演示 root@kitploit: npm install heartbleed-check root@kitploit: var heartbleed =...

cve-2026-49352-poc

CVE-2026-49352 — 9router ハードコードされたJWTシークレットによる認証バイパス 目次 概要 影響を受けるバージョン 根本原因 分析 リポジトリ構造 要件 使用方法 期待される出力 参考文献 免責事項 概要 CVE-2026-49352 は、AI コーディングツール向けのセルフホスト型 Node.js/Next.js プロキシである 9router の脆弱性です。ダッシュボードセッション JWT は JWTSECRET...

MAL-2026-15818 Malicious code in vitest-cli-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1262dc722ebac3b91301efde91e61df9ec9f65ccf91e51c15da53f9b518878b2 Package published as vitest-cli-pro ships a verbatim copy of nodemailer as cover; its declared postinstall runs lib/utils/index.js, which detaches a...

Malicious code in vitest-cli-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1262dc722ebac3b91301efde91e61df9ec9f65ccf91e51c15da53f9b518878b2 Package published as vitest-cli-pro ships a verbatim copy of nodemailer as cover; its declared postinstall runs lib/utils/index.js, which detaches a...

CVE-2026-19754 Baserow 2.3.3 - SQL injection in formula index() JSONB array extraction

Baserow 2.3.3 contains a SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The...

CVE-2026-19754 Baserow 2.3.3 - SQL injection in formula index() JSONB array extraction

Baserow 2.3.3 contains a SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The...

CVE-2026-19754 Baserow 2.3.3 - SQL injection in formula index() JSONB array extraction

Baserow 2.3.3 contains a SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The...

EUVD-2026-69829

Baserow 2.3.3 contains a SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The...

CVE-2026-19754

CVE-2026-19754 is a SQL injection vulnerability in Baserow 2.3.3 , specifically in the index() formula function (used for JSONB array extraction). A low-privileged authenticated user who can create or modify formula fields can supply an undocumented fourth argument that is treated as a SQL templa...

CVE-2026-66750-Insufficient-Access-Controls-Allow-for-Unauthorized-File-Downloads-Let-s-Chat-

セキュリティアドバイザリ: 不十分なアクセス制御により不正なファイルダウンロードが可能 Let's Chat 割り当てられたCVE ID: CVE-2026-66750 概要 GET /files/:id/:name は呼び出し元がログインしていることを確認してからファイルを配信しますが、呼び出し元がそのファイルの属するルームを閲覧できるかどうかは一切確認しません。...

CVE-2026-84442

A vulnerability was identified in MapQuest Get Directions App 10.16.1 on Android. This vulnerability affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component com.mapquest.android.ace. The manipulation leads to path traversal. An attack has to be approached locally...

AZL-98441 CVE-2026-14957 affecting package libreswan 4.15-2

In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However, CERTExtractPublicKey returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate ...

DEBIAN-CVE-2026-14957

In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However, CERTExtractPublicKey returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate ...