33871 matches found
CVE-2026-12743 affiliate-toolkit <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...
EUVD-2026-58590
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-12743: Improper Neutralization of Special Elements used in an SQL Command
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient...
PT-2026-71980
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description A publish-boundary bypass exists in WebSocket broadcast sessions. This allows anonymous readers to establish a WebSocket connection to the publish surface and passively receive real-time content event...
PT-2026-71966
The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...
Linux Distros Unpatched Vulnerability : CVE-2026-73643
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load o...
AZL-98706 CVE-2026-56860 affecting package golang 1.27.1-1
Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking f...
AZL-96665 CVE-2026-56860 affecting package golang 1.26.7-1
Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking f...
CVE-2026-56860
Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking f...
MAL-2026-13974 Malicious code in @khaznatech/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 820c7f4f32895ef501e6926f624897cf41b5f868bc21c60852cbfc101b4cd5ba The package ships install-report.js as a preinstall lifecycle script that unconditionally runs on npm install. The script reads os.hostname and the...
Inefficient Algorithmic Complexity
Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the hashsearch function. An attacker can exhaust CPU resources by sending a specially crafted file list that triggers worst-case quadratic-time behavior in hash lookups. Remediation A fix was...
CVE-2026-73643 js-yaml: Exponential parsing time in the flow collections leads to denial of service
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load or loadAll on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a...
CVE-2026-73643
js-yaml versions 5.0.0–5.2.2 expose a denial-of-service via exponential parsing time when loading untrusted YAML. In src/parser/parser.ts, readFlowCollection can double-parse nested flow sequences, causing O(2^n) work and potential CPU exhaustion for inputs under 200 bytes. Fixed in version 5.2.2...
CVE-2026-73643
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load or loadAll on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a...
MAL-2026-13943 Malicious code in cilm-ui-commons (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 008641dff89b7e4b86993671997e965642fab5620006c5ece0827f0fe72fe0d9 On npm install, the preinstall hook executes index.js which collects host identity data os.hostname, os.userInfo.username, os.homedir, current workin...
CVE-2026-58436
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests...
EUVD-2026-58163
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests...
CVE-2026-58436
The Git repository management system Gitea is vulnerable to a Denial of Service (DoS) condition due to a quadratic-time algorithm in the ParseAcceptLanguage function. This flaw exists within the Locale middleware (specifically in the modules/web/middleware/locale.go file) and is triggered by impr...
