CVE-2026-10591

Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute arbitrary commands via crafted instructions that cause writes to execution-sensitive paths such as .vscode/tasks.json, enabling auto-executio...

CVE-2025-65100

Isar is an integration system for automated root filesystem generation. In versions 0.11-rc1 and 0.11, defining ISARAPTSNAPSHOTDATE alone does not set the correct timestamp value for security distribution, leading to missed security updates. This issue has been patched via commit 738bcbb...

CVE-2025-12184

The MeetingList plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

CVE-2025-12184 MeetingList <= 0.11 - Authenticated (Admin+) Stored Cross-Site Scripting

The MeetingList plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

EUVD-2021-21307

Malware in sbrugna...

EUVD-2009-3317

Malware in sbrugna...

EUVD-2024-39636

Malicious code in bioql PyPI...

EUVD-2022-25253

Malicious code in bioql PyPI...

CVE-2024-42476

In the OAuth library for nim prior to version 0.11, the Authorization Code grant and Implicit grant both rely on the state parameter to prevent cross-site request forgery CSRF attacks where a resource owner might have their session associated with protected resources belonging to an attacker. Whe...

CVE-2025-25160

Cross-Site Request Forgery CSRF vulnerability in Mark Barnes Style Tweaker style-tweaker allows Stored XSS.This issue affects Style Tweaker: from n/a through = 0.11...

WordPress plugin Style Tweaker 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

WordPress Style Tweaker plugin <= 0.11 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Abdi Pranata in WordPress Plugin Style Tweaker versions = 0.11...

CVE-2024-42476 oauth CSRF vulnerability

In the OAuth library for nim prior to version 0.11, the Authorization Code grant and Implicit grant both rely on the state parameter to prevent cross-site request forgery CSRF attacks where a resource owner might have their session associated with protected resources belonging to an attacker. Whe...

CVE-2024-42475

The CVE describes the nim OAuth library prior to 0.11 having insecure generateState entropy in the state values, enabling potential CSRF with a user. The root cause is that generateState did not use a cryptographically secure generator, producing insufficient entropy (less than 128 bits). Version...

CVE-2023-43906

Xolo CMS v0.11 was discovered to contain a reflected cross-site scripting XSS vulnerability...

CVE-2023-43906

Xolo CMS v0.11 was discovered to contain a reflected cross-site scripting XSS vulnerability...

CVE-2023-43906

Xolo CMS v0.11 was discovered to contain a reflected cross-site scripting XSS vulnerability...

OffiDocs Xolo CMS Cross-Site Scripting Vulnerability

OffiDocs Xolo CMS is a content management system from OffiDocs, Inc. A security vulnerability exists in OffiDocs Xolo CMS version v0.11, which stems from the inclusion of a Reflected Cross-Site Scripting XSS vulnerability...

CVE-2023-45138 Change Request Application vulnerable to XSS and remote code execution through change request title

Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly. Starting in version 0.11 and prior to version 1.9.2, it's possible for a user without any specific right to perform script injection and remote code execution just by inserting an...

SUSE CVE-2023-36274

LibreDWG v0.11 to v0.12.5 was discovered to contain a heap buffer overflow via the function bitwriteTF at bits.c...