CVE-2026-103688

The Checkout Files Upload for WooCommerce WordPress plugin (versions before 2.4.0 ) is vulnerable to an unauthenticated arbitrary file upload vulnerability. The root cause is a lack of file type validation when the "accepted file types" setting is left empty, which is the documented method for al...

CVE-2023-26035

POC for CVE-2023-26035 Works for ZoneMinder Versions prior to 1.36.33 and 1.37.33 Vulnerability : Remote Code Execution RCE Usage └─➜ python3 poc.py -h usage: poc.py -h --target TARGET --cmd CMD poc.py: error: the following arguments are required: --target, --cmd Curl Before jumping to rev shell,...

CVE-2026-1928

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with...

CVE-2026-111255

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the uploadimage function. This is due to insufficient file type validation in uploadimage due to a weak Content-Type...

Exploit for CVE-2026-116692

mlflow-scorer-scanner Detection-only triage scanner for ML...

CVE-2021-42013

CVE-2021-42013 Vulnerable service Installation Several options: 1. Docker container docker run -d -p 8080:80 12345qwert123456/apache2450cve-2021-42013 2. Dockerfile git clone https://github.com/12345qwert123456/CVE-2021-42013.git cd CVE-2021-42013-Vulnerable-service/2.4.50 docker build -t...

CVE-2026-1928

The Rank Math SEO plugin for WordPress is vulnerable to PHP Object Injection in versions up to and including 1.0.276 . The flaw exists due to the deserialization of untrusted input within the updateMeta REST API endpoint. An authenticated attacker with Contributor-level access or higher can injec...

CVE-2026-1928 Rank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with...

EUVD-2026-111576

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with...

CVE-2026-111255

The affiliate-toolkit plugin for WordPress (versions up to and including 3.9.2 ) is vulnerable to Arbitrary File Upload via the upload_image function. The root cause is insufficient file type validation, specifically a weak Content-Type prefix check combined with extension derivation from an atta...

EUVD-2026-111574

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the uploadimage function. This is due to insufficient file type validation in uploadimage due to a weak Content-Type...

CVE-2026-111255 affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the uploadimage function. This is due to insufficient file type validation in uploadimage due to a weak Content-Type...

CVE-2026-111255 affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the uploadimage function. This is due to insufficient file type validation in uploadimage due to a weak Content-Type...

CVE-2026-84999

The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the pieregfileupload function. This is due to the plugin performing file type validation via wpcheckfiletype and wpcheckfiletypeandext but never checking...

CVE-2026-117607

Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via importlanguage.php containing a .inc file, then request it through the languag...

EUVD-2026-111559

The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the pieregfileupload function. This is due to the plugin performing file type validation via wpcheckfiletype and wpcheckfiletypeandext but never checking...

CVE-2026-84999

The Pie Register Premium plugin for WordPress (all versions up to and including 3.8.4.0 ) is vulnerable to Unrestricted File Type Upload via the piereg_file_upload function. The root cause is that the plugin performs validation using wp_check_filetype and wp_check_filetype_and_ext but fails to ch...

CVE-2026-84999 Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler

The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the pieregfileupload function. This is due to the plugin performing file type validation via wpcheckfiletype and wpcheckfiletypeandext but never checking...

Aviatrix Controller - Remote Code Execution

An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloudtype for...

Apache Druid Kafka Connect - Remote Code Execution

The vulnerability has the potential to enable a remote attacker with authentication to run any code on the system. This is due to unsafe deserialization that occurs during the configuration of the connector through the Kafka Connect REST API id: CVE-2023-25194 info: name: Apache Druid Kafka Conne...