90842 matches found
CVE-2026-81786: Missing Authorization
Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce = 1.2.2 versions...
CVE-2026-12683: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Stored XSS. This issue affects LIBRID/LIBREF: from 2.01.0.2183 before 18.9.26.2319...
CVE-2026-76059: Protection Mechanism Failure
IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code could bypass the static security scanner by crafting an annotated class-body assignment that resolved to a dangerous callable through alias tracking; the resolved value was never checked against the...
CVE-2026-88899: External Control of File Name or Path
knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system...
PT-2026-89610
Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.5 Description A logic error in the static security scanner allows an attacker to bypass security checks by crafting an annotated class-body assignment. This technique uses alias tracking to resolve ...
CVE-2026-88940: Improper Limitation of a Pathname to a Restricted Directory
knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attackers to enumerate arbitrary directories on the host filesystem. Attackers can traverse the directory structure to locate project directories and identify targets for further...
CVE-2026-88937: Improper Limitation of a Pathname to a Restricted Directory
knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to read and write arbitrary files outside the project root. Attackers can supply malicious templates that traverse directories to overwrite shell profiles, steal...
CVE-2026-7188: Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows SQL Injection. This issue affects Access Control System: before Versiyon 2...
CVE-2026-88939: Incorrect Authorization
knowns through 0.33.0 exempts the project.set action from permission guard checks unconditionally, allowing read-only agent sessions to bypass restrictions. Attackers can invoke project.set to repoint the server at another project directory and obtain write access capabilities...
CVE-2026-9163: Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in GIS Informatics GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: from 1.4.03 before 1.5...
CVE-2026-71643: Uncontrolled Resource Consumption
An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via the EGOReplanFSM component...
CVE-2026-81794: Missing Authorization
Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions...
CVE-2026-84816: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in WPCS = 1.3.2 versions...
CVE-2026-88274: Improper Neutralization of Special Elements used in an OS Command
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID containing shell syntax to execute arbitrary commands as root...
CVE-2026-66674: Authentication Bypass by Spoofing
Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile = 1.42.1 versions...
CVE-2026-81048: Improper Neutralization of Special Elements used in a Command
Dell ThinOS 10, versions prior to 260510.2616, contain an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote Code execution...
CVE-2026-81785: Missing Authorization
Unauthenticated Broken Access Control in BuddyForms = 2.9.0 versions...
CVE-2026-81800: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in Verified Reviews Avis Vérifiés = 2.4.6 versions...