CVE-2026-6105

A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7. This affects an unknown part of the file src/main/java/com/perfree/controller/InstallController.java of the component doInstall Interface. The manipulation leads to improper authorization. The attack may be initiate...

CVE-2026-6105

The CVE-2026-6105 entry affects perfree go-fastdfs-web (up to version 1.3.7). The vulnerability concerns the doInstall Interface in the InstallController.java component, where manipulation leads to improper authorization. A remote attacker could exploit this, and public disclosure of the exploit ...

CVE-2026-6105 perfree go-fastdfs-web doInstall InstallController.java improper authorization

A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7. This affects an unknown part of the file src/main/java/com/perfree/controller/InstallController.java of the component doInstall Interface. The manipulation leads to improper authorization. The attack may be initiate...

go-fastdfs-web 授权问题漏洞

go-fastdfs-web is a web management platform for a distributed file storage system developed by Perfree’s individual developers. Versions of go-fastdfs-web prior to 1.3.7 have vulnerabilities related to authorization. These vulnerabilities stem from improper authorization practices and could lead ...

EUVD-2026-20242

Missing Authorization vulnerability in iPOSPays iPOSpays Gateways WC ipospays-gateways-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iPOSpays Gateways WC: from n/a through = 1.3.7...

CVE-2026-39608

Missing Authorization vulnerability in iPOSPays iPOSpays Gateways WC ipospays-gateways-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iPOSpays Gateways WC: from n/a through = 1.3.7...

CVE-2026-39608

The CVE-2026-39608 entry concerns the WordPress plugin ipospays-gateways-wc (iPOSPays Gateways WC) for WordPress, affected versions are up to and including 1.3.7. The issue is described as a Missing Authorization vulnerability caused by incorrectly configured access control security levels, i.e.,...

CVE-2026-39608 WordPress iPOSpays Gateways WC plugin <= 1.3.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in iPOSPays iPOSpays Gateways WC ipospays-gateways-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iPOSpays Gateways WC: from n/a through = 1.3.7...

PT-2026-31173

Missing Authorization vulnerability in iPOSPays iPOSpays Gateways WC ipospays-gateways-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iPOSpays Gateways WC: from n/a through = 1.3.7...

WordPress plugin iPOSpays Gateways WC 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

CVE-2026-34612 Kestra: Remote Code Execution via SQL Injection

Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra default docker-compose deployment contains a SQL Injection vulnerability that leads to Remote Code Execution RCE in the following endpoint "GET /api/v1/main/flows/search". Once a user is authenticated,...

CVE-2026-34612 Kestra: Remote Code Execution via SQL Injection

Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra default docker-compose deployment contains a SQL Injection vulnerability that leads to Remote Code Execution RCE in the following endpoint "GET /api/v1/main/flows/search". Once a user is authenticated,...

CVE-2026-34612

Kestra (open-source event-driven orchestration platform) prior to version 1.3.7 contains a SQL Injection that enables Remote Code Execution via the GET /api/v1/main/flows/search endpoint. After authentication, a crafted link can trigger payload execution by PostgreSQL using COPY ... TO PROGRAM .....

kestra 安全漏洞

Kestra is an open-source workflow automation platform developed by Kestra. Versions of Kestra prior to 1.3.7 contained security vulnerabilities. These vulnerabilities stemmed from SQL injection vulnerabilities in the/api/v1/main/flows/search endpoint, which could lead to remote code execution...

PT-2026-30266

Name of the Vulnerable Software and Affected Versions Kestra versions prior to 1.3.7 Description Kestra, an open-source event-driven orchestration platform, contains a SQL Injection flaw in the 'GET /api/v1/main/flows/search' endpoint. An authenticated user can trigger this issue by visiting a...

EUVD-2026-12184

The Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing validation checks on the 'thim-ekit/archive-course/get-courses' REST endpoint callback function in all versions up to, and including, 1.3.7...

WordPress plugin Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...

CVE-2026-1870

The Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing validation checks on the 'thim-ekit/archive-course/get-courses' REST endpoint callback function in all versions up to, and including, 1.3.7...

CVE-2026-1870

The CVE-2026-1870 case concerns the WordPress plugin Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor, affected up to version 1.3.7. The vulnerability arises from missing validation in the REST endpoint thim-ekit/archive-course/get-courses, allowing unauthenticated attackers t...

Binding to an Unrestricted IP Address

Overview org.apache.iotdb:iotdb-server is a data management system for time series data, which can provide users specific services, such as, data collection, storage and analysis. Affected versions of this package are vulnerable to Binding to an Unrestricted IP Address in the default configuratio...