271967 matches found
EUVD-2026-71098
The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndashfileuploadprocess' function, which iterates through an entire array and validates only the first file. This...
CVE-2026-12483
The LearnDash LMS plugin for WordPress (versions ≤ 5.1.5 ) is vulnerable to an Unrestricted File Type Upload caused by insufficient input validation in the learndash_fileupload_process function, which validates only the first file in a multi-file array. Authenticated users with subscriber-level a...
Mirth-Connect-CVE-2023-43208
CVE-2023-43208: Unauthenticated Remote Code Execution RCE in NextGen Mirth Connect This exploit leverages a critical deserialization vulnerability within Mirth Connect's XStream engine. It stems from an incomplete patch for CVE-2023-37679, enabling unauthenticated arbitrary code execution across...
CVE-2026-85604
Grav before 2.0.18 affected versions = 2.0.17 contains a remote code execution vulnerability in the Twig sort filter. The sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, so unlike |map/|filter/|reduce, |sort accepts a plain function name inside the sandbox; t...
CVE-2026-85610 OpenPanel before 2.3.0 Remote Code Execution via chart formulas
OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix objects. Attackers can use the recovered constructor to loa...
CVE-2026-85610
OpenPanel before version 2.3.0 is vulnerable to Remote Code Execution via chart formula expressions. The root cause is improper validation of these expressions, which allows authenticated project members with read access to recover the native JavaScript Function constructor through mathjs matrix ...
CVE-2026-85604 Grav before 2.0.18 Remote Code Execution via sort filter
Grav before 2.0.18 affected versions = 2.0.17 contains a remote code execution vulnerability in the Twig sort filter. The sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, so unlike |map/|filter/|reduce, |sort accepts a plain function name inside the sandbox; t...
CVE-2026-85604
Grav before 2.0.19 (versions ≤ 2.0.17) is vulnerable to remote code execution via the Twig sort filter. The sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, allowing a plain function name to pass the sandbox—unlike |map, |filter, and |reduce. The denylist miss...
CVE-2026-85604 Grav before 2.0.18 Remote Code Execution via sort filter
Grav before 2.0.18 affected versions = 2.0.17 contains a remote code execution vulnerability in the Twig sort filter. The sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, so unlike |map/|filter/|reduce, |sort accepts a plain function name inside the sandbox; t...
cve-disclosures
CVE Disclosures — Aman Bahiniya Three CVEs assigned by MITRE...
CVE-2026-82923
The AI Website Builder WordPress plugin GitHub build 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into th...
CVE-2026-82923 AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST Routes
The AI Website Builder WordPress plugin GitHub build 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into th...
EUVD-2026-70990
The AI Website Builder WordPress plugin GitHub build 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into th...
GHSA-F4FR-6HPC-V792 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-2FJV-4HM5-6J23 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-5FQ4-CF4M-H32G vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-8H5Q-977G-XQF2 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-859R-QGH9-2MWV vulnerabilities
Vulnerabilities for packages: chromium...