Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the testConnection API when a malicious H2 JDBC URL is supplied, which leverages the H2 INIT parameter. An attacker can execute arbitrary Java code on the server by sending a crafted request to the API...

CVE-2019-10663

creationtimestamp| type| source ---|---|--- 2026-07-08 14:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq5dskju6a2g...

CVE-2026-58656

Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: , allowing unauthenticated attackers to make fully authenticated cross-origin API requests from any malicious website. Attackers who obtain a leaked JWT token...

EUVD-2026-42266

Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: , allowing unauthenticated attackers to make fully authenticated cross-origin API requests from any malicious website. Attackers who obtain a leaked JWT token...

CVE-2026-56359

n8n prior to 2.8.0 contains a cross-site scripting vulnerability in the credential management flow. Authenticated users can inject malicious JavaScript URLs into OAuth2 credential Authorization URL fields, enabling crafted credentials to cause the victim, who clicks the OAuth authorization button...

CVE-2026-15041

creationtimestamp| type| source ---|---|--- 2026-07-08 12:26:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq54jpsmpb27...

CVE-2026-57260

creationtimestamp| type| source ---|---|--- 2026-07-08 12:22:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq54c2bmsp26...

CVE-2026-57247

creationtimestamp| type| source ---|---|--- 2026-07-08 12:09:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq53l3gx5i2x...

CVE-2026-57254

creationtimestamp| type| source ---|---|--- 2026-07-08 12:07:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq53gm2i5k2g...

RLSA-2026:36317 Important: skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 crypto/x509: golang: golang crypto/x509: Denial of...

CVE-2026-57062

creationtimestamp| type| source ---|---|--- 2026-07-08 12:00:53+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mq5337tlhh23 2026-07-10 12:01:07+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mqc3zhjevb2d...

CVE-2026-57258

creationtimestamp| type| source ---|---|--- 2026-07-08 11:53:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq52oi32db2k...

CVE-2026-54406

creationtimestamp| type| source ---|---|--- 2026-07-08 11:01:21+00:00| seen| https://vulnerability.circl.lu/bundle/ebad18a5-251f-49a4-b877-c63995fd13a6 2026-07-09 20:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqaif74m6425...

CVE-2026-14482

creationtimestamp| type| source ---|---|--- 2026-07-08 07:27:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq4lrjxew42l 2026-07-09 00:00:40+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mq6dcbzxg52n...

CVE-2026-14500

The CVE-2026-14500 entry concerns the Bulk Order Update for WooCommerce plugin for WordPress (

EUVD-2026-42175

The Bulk Order Update for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 1.6. This is due to the bouwfetchcsvdata AJAX handler being registered on the wpajaxnopriv hook with no capability or nonce check, and passing the attacker-supplied...

CVE-2026-14500 Bulk Order Update for WooCommerce <= 1.6 - Unauthenticated Arbitrary File Read via 'csv_url' Parameter

The Bulk Order Update for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 1.6. This is due to the bouwfetchcsvdata AJAX handler being registered on the wpajaxnopriv hook with no capability or nonce check, and passing the attacker-supplied...

CVE-2026-12041

creationtimestamp| type| source ---|---|--- 2026-07-08 05:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mq4ehfuu5k2r 2026-07-08 08:01:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq4npvpahf2e...

GHSA-9G8F-H8F3-HJCM

creationtimestamp| type| source ---|---|--- 2026-07-08 05:00:05+00:00| seen| https://bsky.app/profile/selfhost.directory/post/3mq4dkpqdgy2h...

CVE-2026-14244 Jssor Slider by jssor.com <= 3.1.24 - Unauthenticated Arbitrary File Read via 'url' Parameter

The Jssor Slider by jssor.com plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.1.24 via the 'url' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...