115673 matches found
GO-2026-5429 SiYuan: Path Traversal via Double URL Encoding in `/export/` Endpoint (Incomplete Fix Bypass for CVE-2026-30869) in github.com/siyuan-note/siyuan/kernel
SiYuan: Path Traversal via Double URL Encoding in /export/ Endpoint Incomplete Fix Bypass for CVE-2026-30869 in github.com/siyuan-note/siyuan/kernel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If th...
CVE-2026-54250
K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names can be written to...
CVE-2026-12921
In AzeoTech DAQFactory versions 21.1 and prior, a Use After Free vulnerability can be exploited by an attacker using specially crafted .ctl files which can result in code execution...
GO-2026-5193 Gogs: XSS in .ipynb files renderer due to outdated notebookjs in gogs.io/gogs
Gogs: XSS in .ipynb files renderer due to outdated notebookjs in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, pleas...
CVE-2026-55700
pnpm is a package manager. From 11.3.0 until 11.5.3, pnpm stage download derived a local filename from registry-controlled package name and version fields. A crafted manifest could escape the selected download directory and overwrite another reachable file. The merged fix validates both fields,...
CVE-2026-54250 K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression
K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names can be written to...
CVE-2026-54092 File Browser: DoS Vulnerability on Public Login API
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, unchecked passwords maximums allow for an arbitrarily large password to be passed into the login API. This spikes CPU and memory, and after...
@ainsleydev/payload-helper (>=0.0.1, <=0.0.2), @bsct/payload (1.0.0) +89 more potentially affected by CVE-2026-48714 via i18next-http-middleware (>=3.0.2, <=3.9.6)
i18next-http-middleware NPM version =3.0.2, =0.0.1, =1.0.1, =0.0.1, =0.0.1, =0.0.1, =8.0.0-alpha1, =3.0.0-rc.0, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.0.3 and more Source cves: CVE-2026-48714 Source advisory: OSV:GHSA-F49M-VF83-692W...
@applydigital/claude (>=1.0.0, <=1.2.1), @bsklaroff/yaac (>=0.0.1, <=0.0.6) +11 more potentially affected by CVE-2026-46406 via @anthropic-ai/claude-code (>=2.1.63, <=2.1.117)
@anthropic-ai/claude-code NPM version =2.1.63, =1.0.0, =0.0.1, =0.7.5, =0.6.1-beta.1, =1.83.1, =0.8.1, =0.8.0, =1.0.33, =1.0.0-dev.1, =2.1.99, =1.2.2, =1.2.3 Source cves: CVE-2026-46406 Source advisory: OSV:GHSA-4VP2-6Q8C-PVQ2...
CVE-2026-56071
Unauthenticated Cross Site Scripting XSS in Forminator = 1.53.1 versions...
CVE-2026-56053
Subscriber PHP Object Injection in EventPrime = 4.3.4.1 versions...
CVE-2026-56042 WordPress Advanced Order Export For WooCommerce plugin <= 4.0.9 - Cross Site Scripting (XSS) vulnerability
Customer Cross Site Scripting XSS in Advanced Order Export For WooCommerce = 4.0.9 versions...
CVE-2026-56006
Unauthenticated Cross Site Scripting XSS in H5P = 1.17.6 versions...
CVE-2026-56005 WordPress WP Activity Log plugin <= 5.6.3.1 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in WP Activity Log = 5.6.3.1 versions...
EUVD-2026-39374
Subscriber Cross Site Scripting XSS in WP Activity Log = 5.6.3.1 versions...
CVE-2026-54823 WordPress Widget Options plugin <= 4.2.3 - Remote Code Execution (RCE) vulnerability
Contributor Remote Code Execution RCE in Widget Options = 4.2.3 versions...
CVE-2026-54823
CVE-2026-54823 affects the WordPress Widget Options plugin, specifically versions
CVE-2026-57619
Contributor Sensitive Data Exposure in Elementor Website Builder = 4.1.3 versions...
