EUVD-2026-22225

Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers. This issue affects Apache APISIX: from 2.12.0 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue...

CVE-2026-33456

Livestatus injection in the notification test mode in Checkmk 2.5.0b4 and 2.4.0p26 allows an authenticated user with access to the notification test page to inject arbitrary Livestatus commands via a crafted service description...

CVE-2026-3017 Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts <= 3.0.12 - Authenticated (Administrator+) PHP Object Injection

The Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.0.12 via deserialization of untrusted input in the importshortcodes function. This makes it possible for authenticate...

Vulnerable-Web-App-Scanner

Vulnerable-Web-App-Scanner Pent...

RCE (Remote Code Execution) at c3p0 dependency in Crucible Server

This High severity RCE Remote Code Execution vulnerability was introduced in version 4.9.0 of Crucible Server. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.9 and a CVSS Vector of code:java CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H code allows an...

CVE-2026-40288 PraisonAI: Critical RCE via `type: job` workflow YAML

PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents, the workflow engine is vulnerable to arbitrary command and code execution through untrusted YAML files. When praisonai workflow run loads a YAML file with type: job, the...

-lidonghui (1.0.0), -test-bitbucket-branch-manager (1.0.1) +60186 more potentially affected by CVE-2026-40895 via follow-redirects (>=1.0.0, <=1.15.11)

follow-redirects NPM version =1.0.0, =1.0.1, =1.0.0, =1.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.1 - 03-asenkronsdasdsadavehttprequest 1.0.0 - 04-17 1.0.0 - 04-17zy 1.0.0 - 04-a 1.0.0 and more Source cves: CVE-2026-40895 Source advisory: SNYK:JS-FOLLOWREDIRECTS-16032162...

a3mo_lib (>=0.1.0, <=0.1.1), abacuz (>=0.1.0, <=0.1.1) +10169 more potentially affected by unknown CVE via rand (>=0.7.0-pre.2, <=0.8.5)

rand CARGO version =0.7.0-pre.2, =0.1.0, =0.1.0, =0.1.0, =0.7.0, =0.2.0-beta.4, =0.1.0, =0.1.0, =0.1.1, =0.1.1, =0.0.44, =0.0.5, =0.0.5, =0.0.14 and more Source cves: unknown CVE Source advisory: OSV:GHSA-CQ8V-F236-94QC...

EUVD-2026-22184

MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an Eval Injection vulnerability in the Markdown rendering engine that allows any user capable of interacting with the AI chat interface to execute arbitrary JavaScript in the browsers of other users, including...

PT-2026-32922

ColdFusion | Improper Input Validation CWE-20 CVE: CVE-2026-27306 PT ID: PT-2026-32922 Vendor: Adobe Product: ColdFusion CVSS: 8.4 Credits: n/a Description: ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary co...

WordPress plugin JetEngine SQL注入漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

Adobe InCopy < 20.5.3 / 21.0 < 21.3.0 Multiple Vulnerabilities Arbitrary code execution (APSB26-33)

The version of Adobe InCopy installed on the remote host is prior to 20.5.3, 21.3.0. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-33 advisory. - InCopy versions 20.5.2, 21.2 and earlier are affected by an out-of-bounds write vulnerability that could result in...

Linux Distros Unpatched Vulnerability : CVE-2026-33905

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the -sample...

Fortinet FortiSandbox 操作系统命令注入漏洞

Fortinet FortiSandbox is an APT Advanced Persistent Threat protection device developed by the American company Fortinet. This device offers features such as dual sandbox technology, dynamic threat intelligence systems, a real-time control panel, and reporting capabilities. Versions of Fortinet...

Apache Apisix 安全漏洞

Apache Apisix is a cloud-native microservices API gateway service provided by the Apache Foundation in the United States. This software is implemented based on OpenResty and etcd, featuring dynamic routing and hot loading of plugins. It is suitable for API management within microservice systems...

PT-2026-32628

Name of the Vulnerable Software and Affected Versions Leaflet versions prior to 1.9.5 Description Cross-Site Scripting XSS occurs via the bindPopup function. This function renders user-supplied input as raw HTML without sanitization, which allows the injection of arbitrary JavaScript code through...

PT-2026-32929

Docmost is open-source collaborative wiki and documentation software. Versions prior to 0.70.0 are vulnerable to a stored cross-site scripting XSS attack due to improper handling of MIME type spoofing GHSL-2026-052. An attacker could exploit this flaw to inject malicious scripts, potentially...

PT-2026-32888

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser...

PT-2026-32609

Name of the Vulnerable Software and Affected Versions RUGGEDCOM CROSSBOW Secure Access Manager Primary SAM-P versions prior to 5.8 Description User Administrators are permitted to administer groups to which they belong. This flaw allows an authenticated User Administrator to escalate their...

Ubuntu: Security Advisory (USN-8148-6)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...