32962 matches found
Webnus Inc. Modern Events Calendar - Broken Access Control
Webnus Inc. Modern Events Calendar = 7.29.0 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers bypass authorization, exploit requires no special privileges. id: CVE-2026-32583 info: name: Webnus Inc. Modern Events...
CKAN DataStore SQL Search - SQL Injection
CKAN, an open-source data management system used for powering open data portals, contains an unauthenticated SQL injection vulnerability in the datastoresearchsql API endpoint. id: CVE-2026-42031 info: name: CKAN DataStore SQL Search - SQL Injection author: theamanrawat severity: high description...
Flowise - NVIDIA NIM Endpoints Missing Authentication
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router /api/v1/nvidia-nim/ is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generati...
HT Mega < 3.0.7 - Sensitive Information Disclosure
The HT Mega plugin for WordPress is vulnerable to Sensitive Information Exposure via AJAX actions. This template dynamically extracts the security nonce before exploitation. id: CVE-2026-4106 info: name: HT Mega 3.0.7 - Sensitive Information Disclosure author: EFETR severity: high description: |...
WordPress User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation
User Registration & Membership WordPress plugin = 5.1.2 contains an improper privilege management vulnerability caused by accepting user-supplied roles without server-side allowlist enforcement, letting unauthenticated attackers create administrator accounts id: CVE-2026-1492 info: name: WordPres...
Apache Tomcat - Cross-Site Scripting
Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, fro...
Mailcow < 2026-03b - Href Link Injection
mailcow 2026-03b reflects raw REQUESTURI into JavaScript and href links on the login page, allowing attackers to inject parameters that break JS logic and enable phishing. id: CVE-2026-40878 info: name: Mailcow 2026-03b - Href Link Injection author: ritikchaddha severity: low description: | mailc...
Magento 2 Amasty Order Attributes < 4.0.0 - Unauthenticated Arbitrary File Upload
Amasty Order Attributes for Magento 2 4.0.0 contains an unrestricted file upload vulnerability caused by lack of authentication and validation in the upload endpoint, letting unauthenticated attackers upload arbitrary files including PHP, enabling remote code execution or malware hosting. id:...
W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read
W3 Total Cache WordPress plugin = 2.9.4 contains a directory traversal caused by improper handling in setupSources function, letting unauthenticated attackers read arbitrary files, exploit requires manual minify mode enabled with specific filename. id: CVE-2026-9282 info: name: W3 Total Cache =...
IBM Langflow - Remote Code Execution
IBM Langflow OSS 1.0.0 through 1.10.0 contains a remote code execution caused by chaining /api/v1/autologin and /api/v1/validate/code endpoints, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication. id: CVE-2026-9198 info: name: IBM Langflow - Remo...
ROOT-APP-NPM-CVE-2026-59871 CVE-2026-59871 in tar - Patched by Root
Root has patched CVE-2026-59871 in the tar package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-9679 CVE-2026-9679 in undici - Patched by Root
Root has patched CVE-2026-9679 in the undici package for Root:npm. Multiple fixed versions available...
ROOT-OS-ALPINE-317-CVE-2026-34180 CVE-2026-34180 in openssl - Patched by Root
Root has patched CVE-2026-34180 in the openssl package for Root:Alpine:3.17. Multiple fixed versions available...
ROOT-OS-ALPINE-317-CVE-2026-45447 CVE-2026-45447 in openssl - Patched by Root
Root has patched CVE-2026-45447 in the openssl package for Root:Alpine:3.17. Multiple fixed versions available...
ROOT-OS-ALPINE-317-CVE-2026-31789 CVE-2026-31789 in openssl - Patched by Root
Root has patched CVE-2026-31789 in the openssl package for Root:Alpine:3.17. Multiple fixed versions available...
ROOT-OS-ALPINE-317-CVE-2026-28390 CVE-2026-28390 in openssl - Patched by Root
Root has patched CVE-2026-28390 in the openssl package for Root:Alpine:3.17. Multiple fixed versions available...
ROOT-OS-ALPINE-317-CVE-2026-28387 CVE-2026-28387 in openssl - Patched by Root
Root has patched CVE-2026-28387 in the openssl package for Root:Alpine:3.17. Multiple fixed versions available...
Gitea <= 1.27.0 - Pre-Auth Remote Code Execution
Gitea versions 1.17 through 1.27.0 contain a remote code execution vulnerability in the diffpatch endpoint caused by an add/add collision that writes an executable Git hook into the bare repository's GITDIR. An attacker with write access can execute arbitrary commands as the Gitea service account...