44928 matches found
CVE-2026-46939: Undefined Security Weakness
Vulnerability in the Oracle Configure to Order product of Oracle E-Business Suite component: Supply to Order Workbench. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...
PT-2026-50319
Subscriber Arbitrary File Upload in Kids Gift Shop = 0.5.4 versions...
PT-2026-50345
Unauthenticated PHP Object Injection in JetEngine = 3.8.10 versions...
PT-2026-50419
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.109...
PT-2026-50320
Subscriber Arbitrary File Upload in Charity Zone = 1.1.1 versions...
CVE-2025-60223: Improper Limitation of a Pathname to a Restricted Directory
Subscriber Arbitrary File Deletion in WPBot Pro Wordpress Chatbot = 13.6.5 versions...
PT-2026-50421
Improper Control of Generation of Code 'Code Injection' vulnerability in Monetizemore Advanced Ads allows Remote Code Inclusion. This issue affects Advanced Ads: from n/a through 2.0.21...
Click-to-Run Package Services Privilege Escalation
The vulnerability of the Click-to-Run package services for Microsoft Office and Microsoft 365 Apps for Enterprise lies in the ability to exploit memory after it is freed. Exploiting this vulnerability could allow an attacker to enhance their privileges...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization through the improper enforcement of access controls in the pull request creation and push authorization processes. An attacker can gain unauthorized write access to repositories by abusing the "Allow edits from...
n8n: Microsoft SQL Node Prototype Pollution
Impact An authenticated user with permission to create or modify workflows could achieve global prototype pollution via the Microsoft SQL node by supplying a crafted value as the table parameter. This pollutes Object.prototype process-wide for the lifetime of the n8n server process, causing...
GHSA-WW63-PV5X-VFC8 Daytona: Public sandbox previews remain accessible for up to one hour after being made private
Summary Sandbox previews that were switched from public to private could remain reachable without authentication for a short period after the change, due to a cached visibility state that was not invalidated when the sandbox's visibility changed. Impact When a sandbox owner changed a preview from...
CVE-2026-11409 OS Command Injection in IPv6 PPPoE Configuration in TP-Link TL-WR940N
An authenticated OS command injection vulnerability exists in the IPv6 PPPoE configuration handler in TL-WR940N v6 due to improper sanitization of user input. An attacker with administrative access may exploit this issue to execute arbitrary system commands with elevated privileges...
CVE-2026-40759 WordPress Esmée theme <= 1.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Esmée = 1.4 versions...
CVE-2026-40755 WordPress TechLink theme <= 1.3 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in TechLink = 1.3 versions...
CVE-2026-40755 WordPress TechLink theme <= 1.3 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in TechLink = 1.3 versions...
CVE-2026-40736 WordPress Laurits theme <= 1.5.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Laurits = 1.5.1 versions...
CVE-2026-40736
WordPress Laurits theme
CVE-2026-39580 WordPress Micdrop theme <= 1.3.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Micdrop = 1.3.1 versions...