cve-2026-63030-lab

CVE-2026-63030 — wp2shell Lab Pre-Authentication RCE in WordPress Core via REST API Batch Route Confusion + SQL Injection Overview wp2shell is a chain of two independently low-severity bugs in WordPress core that, when combined, allow an unauthenticated remote attacker to: 1. Reach an SQL injecti...

EUVD-2026-97674

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures an authenticated Query Console user to a malicious page could submit unauthorized requests and execute server-side code with the victim's...

CVE-2026-109360 MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP

MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that loadstatedictfromurl unpickles without weightsonly=True,...

CVE-2026-109360 MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP

MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that loadstatedictfromurl unpickles without weightsonly=True,...

CVE-2026-109360

The MONAI library (versions 0.4.0 before 1.6.1) is vulnerable to Remote Code Execution (RCE) when constructing SEResNet50 or other SENet models with pretrained=True. The root cause is the insecure unpickling of pretrained weights fetched over plaintext HTTP via the load_state_dict_from_url functi...

EUVD-2026-97662

MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that loadstatedictfromurl unpickles without weightsonly=True,...

EUVD-2026-97653

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::withcapacity to...

CVE-2026-109351 Gitoxide gix-pack before 0.75.0 Denial of Service via Pack Header Object Count

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::withcapacity to...

CVE-2026-109347

Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PH...

EUVD-2026-97649

Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PH...

CVE-2026-109321 Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass

Grav Login OAuth plugin grav-plugin-login-oauth before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic . username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess ...

EUVD-2026-97623

Grav Login OAuth plugin grav-plugin-login-oauth before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic . username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess ...

CVE-2026-109321 Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass

Grav Login OAuth plugin grav-plugin-login-oauth before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic . username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess ...

CVE-2026-109294 Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image

Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses, whi...

CVE-2026-109294

Open WebUI versions 0.6.42 before 0.11.4 are vulnerable to an uncontrolled resource consumption vulnerability (CWE-400). Authenticated users can trigger a denial of service for all users by providing compressed remote image URLs in chat messages. The flaw exists in the get_image_base64_from_url f...

CVE-2026-109294 Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image

Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses, whi...

CVE-2026-109255 FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license_check_stream_length

FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in licensecheckstreamlength that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients. Attackers can send a crafted SERVERLICENSEREQUEST with a large scopeCount that bypasses length checks, causi...

CVE-2026-109255

FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in licensecheckstreamlength that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients. Attackers can send a crafted SERVERLICENSEREQUEST with a large scopeCount that bypasses length checks, causi...

CVE-2026-109255 FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license_check_stream_length

FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in licensecheckstreamlength that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients. Attackers can send a crafted SERVERLICENSEREQUEST with a large scopeCount that bypasses length checks, causi...

EUVD-2026-97699

FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in licensecheckstreamlength that allows a malicious RDP server to trigger a heap buffer overflow on 32-bit clients. Attackers can send a crafted SERVERLICENSEREQUEST with a large scopeCount that bypasses length checks, causi...