269217 matches found
CVE-2026-73343
Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...
EUVD-2026-60774
Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...
CVE-2026-73343
WP Compress is a WordPress image optimization plugin. An unauthenticated Remote Code Execution (RCE) vulnerability affects versions prior to 7.20.01 , allowing a remote attacker with no prior access to execute arbitrary code on the host, resulting in full compromise of confidentiality, integrity,...
CVE-2026-73343 WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability
Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...
EUVD-2026-60901
Customer PHP Object Injection in Essential Real Estate = 5.3.3 versions...
EUVD-2026-60898
Contributor Remote Code Execution RCE in Cwicly = 1.4.4 versions...
CVE-2026-32444 WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability
Contributor Remote Code Execution RCE in Cwicly = 1.4.4 versions...
CVE-2026-32444
Contributor Remote Code Execution RCE in Cwicly = 1.4.4 versions...
CVE-2026-32444 WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability
Contributor Remote Code Execution RCE in Cwicly = 1.4.4 versions...
CVE-2026-28570
Unauthenticated Local File Inclusion in Vavo Core = 2.3.0 versions...
CVE-2026-74988
Internally found bugs present in Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR...
CVE-2026-75829 grav-plugin-api before 1.0.15 Twig SSTI via translate endpoint
grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate endpoint, allowing attackers with api.pages.write permission to persist pages with process.twig enabled. Attackers can submit crafted header and content parameters to execute server-side template injection...
EUVD-2026-60591
Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...
CVE-2026-75827
Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...
CVE-2026-74902 SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload
SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access...
WordPress Query Wrangler plugin <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter vulnerability
Authenticated Subscriber+ Remote Code Execution via 'options' Parameter vulnerability discovered by Enis - TURKOL YAZILIM in WordPress Plugin Query Wrangler versions = 1.5.57...
RHSA-2026:55860 Red Hat Security Advisory: haproxy security update
Bulletin has no description...
RHSA-2026:55784 Red Hat Security Advisory: unbound security update
Bulletin has no description...
BIT-AIRFLOW-2026-67587 Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` deserialization gadget
Apache Airflow's Task SDK rebuilt a Callback object from serialized data by re-running its constructor, which imports the module named by the stored callback path. Because SyncCallback is itself an Airflow class it passes the default alloweddeserializationclasses allow-list, so tightening that...