490236 matches found
WordPress Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin <= 6.2.8 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Plugin FluentForm versions = 6.2.8...
EUVD-2026-53330
The wp-downloadmanager WordPress plugin, in version 1.68.11 also affecting the 6.9.4 release line, allows an admin-privileged user currentusercan'managedownloads' to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wpcheckfiletypeandext, no...
CVE-2026-18933 wp-downloadmanager - Unrestricted File Upload via Missing Extension/MIME Validation and Path Traversal
The wp-downloadmanager WordPress plugin, in version 1.68.11 also affecting the 6.9.4 release line, allows an admin-privileged user currentusercan'managedownloads' to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wpcheckfiletypeandext, no...
CVE-2026-18933
The wp-downloadmanager WordPress plugin, in version 1.68.11 also affecting the 6.9.4 release line, allows an admin-privileged user currentusercan'managedownloads' to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wpcheckfiletypeandext, no...
CVE-2026-17578
Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled. If a producer sends messages at a sustained high rate withou...
Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup
An unauthenticated attacker can read any file the service account can access on Gitea , the self-hosted Git platform, in versions 1.22.1 through 1.27.0. No login, no repository write access. A public repository and crafted Org-mode markup are enough. The flaw is fixed in Gitea 1.27.1. The file-re...
CVE-2026-61891
In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend exposes HTTP file-download endpoints GET /file, GET /files/, PUT /files/ that convert a client-supplied URI directly to a filesystem path and stream the file, without confining it to the workspace or any...
CVE-2026-61891
In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend exposes HTTP file-download endpoints GET /file, GET /files/, PUT /files/ that convert a client-supplied URI directly to a filesystem path and stream the file, without confining it to the workspace or any...
EUVD-2026-53326
In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend binds POST /file-upload in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart uri field and calls fs.movetmp, target, overwrite: true with no workspace...
CVE-2026-71247 Documenso - Assistant Recipient Can Forge Another Signer's Signature in Sequential-Signing Documents
Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. A newer V2 signing path...
CVE-2026-12609
In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the @theia/plugin-ext backend exposes the /hostedPlugin/:pluginId/:path HTTP endpoint, which resolves the requested file path with path.resolvelocalPath, filePath without verifying that the resolved path stays within the plugin's...
CVE-2026-59251 affecting package erlang for versions less than 26.2.5.21-3
CVE-2026-59251 affecting package erlang for versions less than 26.2.5.21-3. A patched version of the package is available...
CVE-2026-42792 affecting package erlang for versions less than 26.2.5.21-3
CVE-2026-42792 affecting package erlang for versions less than 26.2.5.21-3. A patched version of the package is available...
CVE-2026-55737 affecting package erlang for versions less than 26.2.5.21-3
CVE-2026-55737 affecting package erlang for versions less than 26.2.5.21-3. A patched version of the package is available...
CVE-2026-43871 affecting package vitess for versions less than 19.0.4-12
CVE-2026-43871 affecting package vitess for versions less than 19.0.4-12. A patched version of the package is available...
CVE-2026-55969 affecting package vitess for versions less than 19.0.4-12
CVE-2026-55969 affecting package vitess for versions less than 19.0.4-12. A patched version of the package is available...
CVE-2026-58227 affecting package erlang for versions less than 26.2.5.21-3
CVE-2026-58227 affecting package erlang for versions less than 26.2.5.21-3. A patched version of the package is available...
WordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by Bonds in WordPress Plugin Type Hub versions = 2.0.6...
CVE-2026-14304
In Eclipse Accessibility Tools Framework ACTF versions up to 1.6.0 including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0, it has been identified that an XML External Entity XXE vulnerability exists. If this vulnerability is exploited, a malicious...