CVE-2018-25324

Simple Fields 0.2 through 0.3.5 WordPress Plugin contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by injecting null bytes into the wpabspath parameter on PHP versions before 5.3.4. Attackers can supply malicious wpabspath values to...

CVE-2018-25324

The CVE-2018-25324 entry concerns the WordPress plugin Simple Fields versions 0.2–0.3.5, which contains a local file inclusion (LFI) flaw via the wp_abspath parameter. Unauthenticated attackers can read arbitrary files (e.g., /etc/passwd) by injecting null bytes into wp_abspath on PHP versions be...

CVE-2026-8739

creationtimestamp| type| source ---|---|--- 2026-05-17 09:02:35+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mlzyqregxy26 2026-05-17 12:22:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm2e2tqw5c2p...

CVE-2026-8730

creationtimestamp| type| source ---|---|--- 2026-05-17 08:31:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlzx4wwz7d2c...

CVE-2026-8719

creationtimestamp| type| source ---|---|--- 2026-05-17 04:37:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlzk2kmiy32i 2026-05-17 17:12:56+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mm2ubcolsp2s 2026-05-18 05:18:36+00:00| seen|...

CVE-2018-25334

creationtimestamp| type| source ---|---|--- 2026-05-17 04:16:45+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2018-25334 2026-05-17 15:17:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm2nt77cup2r...

CVE-2018-25335

creationtimestamp| type| source ---|---|--- 2026-05-17 04:16:45+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2018-25335 2026-05-17 14:33:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm2ldkldil2h 2026-05-25 07:46:43+00:00| seen|...

PT-2026-41587

Name of the Vulnerable Software and Affected Versions vercel ai versions prior to 3.0.98 Description A server-side request forgery SSRF issue exists in the provider-utils component. The flaw is located in the validateDownloadUrl function within the packages/provider-utils/src/download-blob.ts fil...

PT-2026-41550

Simple Fields 0.2 through 0.3.5 WordPress Plugin contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by injecting null bytes into the wp abspath parameter on PHP versions before 5.3.4. Attackers can supply malicious wp abspath values to simp...

Vercel AI SDK 代码问题漏洞

Vercel AI SDK is a JavaScript SDK developed by Vercel that supports the integration of large language models, streaming responses, and AI application development. Versions of Vercel AI 3.0.97 and earlier contain code vulnerabilities. These vulnerabilities stem from the validateDownloadUrl functio...

CVE-2026-8723

creationtimestamp| type| source ---|---|--- 2026-05-16 23:21:41+00:00| published-proof-of-concept| https://github.com/ljharb/qs/security/advisories/GHSA-q8mj-m7cp-5q26 2026-05-17 00:32:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlz4e2r27x2h...

CVE-2021-47974

creationtimestamp| type| source ---|---|--- 2026-05-16 17:16:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlydyrh7z52i...

CVE-2021-47976

creationtimestamp| type| source ---|---|--- 2026-05-16 17:13:04+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlydpszapy2p...

CVE-2021-47955

creationtimestamp| type| source ---|---|--- 2026-05-16 16:37:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlybsrst222v...

EUVD-2020-31237

WordPress Theme Wibar 1.1.8 contains a stored cross-site scripting vulnerability in the Brand component that allows authenticated users to inject malicious scripts by manipulating the Logo URL parameter. Attackers with editor, administrator, contributor, or author privileges can inject...

CVE-2020-37235

CVE-2020-37235 concerns WordPress Theme Wibar 1.1.8, where a stored XSS flaw exists in the Brand component. The vulnerability allows authenticated users with editor/administrator/contributor/author roles to inject base64-encoded script payloads via the ftc_brand_url input field, resulting in arbi...

CVE-2020-37235 WordPress Theme Wibar 1.1.8 Stored Cross-Site Scripting via Brand Component

WordPress Theme Wibar 1.1.8 contains a stored cross-site scripting vulnerability in the Brand component that allows authenticated users to inject malicious scripts by manipulating the Logo URL parameter. Attackers with editor, administrator, contributor, or author privileges can inject...

CVE-2026-5340

creationtimestamp| type| source ---|---|--- 2026-05-16 11:32:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mlxqqwqisu2l...

Server-Side Request Forgery

Arcane is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to the /api/templates/fetch endpoint accepting a user-controlled url parameter and performing server-side HTTP requests without authentication or validation of the URL scheme and destination host, allowing...

Server-Side Request Forgery (SSRF)

github.com/kyverno/kyvern is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to the apiCall feature in ClusterPolicy automatically attaching the admission controller's ServiceAccount token to outbound HTTP requests without validating the destination URL, which allows an...