CVE-2025-14938

The Listeo Core plugin for WordPress is vulnerable to unauthenticated arbitrary media upload in all versions up to, and including, 2.0.27 via the "listeocorehandledroppedmedia" function. This is due to missing authorization and capability checks on the AJAX endpoint handling file uploads. This...

EUVD-2026-19079

A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This affects the function strcpy of the file /goform/formNatStaticMap. Performing a manipulation of the argument NatBind results in buffer overflow. Remote exploitation of the attack is possible. The exploit is now public...

CVE-2026-5572 Technostrobe HI-LED-WR120-G2 cross-site request forgery

A security flaw has been discovered in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. This affects an unknown function. Performing a manipulation results in cross-site request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Th...

GuvenliWebYazilimiGelistirme-CipherNone-

🛡️ CipherNone: JWT "alg: none" Vulnerability & Hardening Lab...

CVE-2026-2600

The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ekittabtitle' parameter in the Simple Tab widget in all versions up to, and including, 3.7.9 due to insufficient input sanitization and output escaping on user supplied...

CVE-2026-5556

CVE-2026-5556 affects badlogic pi-mono up to 0.58.4. The vulnerability targets the function discoverAndLoadExtensions in packages/coding-agent/src/core/extensions/loader.ts , enabling code injection. Remote exploitation is possible; the exploit has been disclosed publicly and may be used. The ven...

CourseSEL SQL注入漏洞

CourseSEL is an online course registration system developed by Halex developers. Versions of CourseSEL 1.1.0 and earlier had a SQL injection vulnerability. This vulnerability stemmed from incorrect handling of the parameter seid, which could lead to SQL injections...

Mono 代码注入漏洞

Mono is an open-source software platform used for creating .NET cross-platform applications. Version 0.58.4 of Mono contains a code injection vulnerability, which stems from the cross-site scripting found in the file packages/web-ui/src/tools/artifacts/SvgArtifact.ts...

Linux Distros Unpatched Vulnerability : CVE-2026-31933

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, specially crafted traffic can cause Suricata to slow down, affecting...

CVE-2018-25245

7 Tik 1.0.1.0 contains a denial of service vulnerability that allows attackers to crash the application by submitting excessively long input strings to the search functionality. Attackers can paste a buffer of 7700 characters into the search bar to trigger an application crash...

CVE-2026-1233 Text to Speech (TTS) by Mementor <= 1.9.8 - Use of Hardcoded Password to Unauthenticated Remote Database Access

The Text to Speech for WP AI Voices by Mementor plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.9.8. This is due to the plugin containing hardcoded MySQL database credentials for the vendor's external telemetry server in the...

EUVD-2026-18989

The Widgets for Social Photo Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'feeddata' parameter keys in all versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2025-15064

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user description field in all versions up to, and including, 2.11.1 due to insufficient input sanitization a...

CVE-2026-0664

The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttontext' parameter in all versions up to, and including, 1.7.1049 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

fuel-p2p (>=0.4.0, <=0.5.0), libp2p (>=0.40.0-rc.1, <=0.42.2) +1 more potentially affected by CVE-2026-35457 via libp2p-rendezvous (>=0.1.0, <=0.3.0)

libp2p-rendezvous CARGO version =0.1.0, =0.4.0, =0.40.0-rc.1, =0.20.0, =0.21.0 Source cves: CVE-2026-35457 Source advisory: OSV:GHSA-V5HW-CV9C-RPG7...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +13 more potentially affected by CVE-2026-34511 via openclaw (>=2026.3.22, <=2026.4.1)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 - tokaroo-openclaw-provider 0.1.1 Source cves: CVE-2026-34511 Source advisory: OSV:GHSA-9JPJ-G8VV-J5MF...

defu: Prototype pollution via `__proto__` key in defaults argument

Impact Applications that pass unsanitized user input e.g. parsed JSON request bodies, database records, or config files from untrusted sources as the first argument to defu are vulnerable to prototype pollution. A crafted payload containing a proto key can override intended default values in the...

@altipla/directus-sdk-utils (0.7.2), @bicou/directus-extension-imagga (>=1.6.3, <=1.6.6) +5 more potentially affected by CVE-2026-35442 via directus (>=11.0.0, <=11.16.1)

directus NPM version =11.0.0, =1.6.3, =20.0.0-rc.0, =34.0.1 - @fahami/directus-pkce 1.0.0 - abcprotocol 0.0.1 Source cves: CVE-2026-35442 Source advisory: OSV:GHSA-38HG-WW64-RRWC...

@altipla/directus-sdk-utils (0.7.2), @bicou/directus-extension-imagga (>=1.6.3, <=1.6.6) +4 more potentially affected by CVE-2026-35412 via directus (>=11.0.0, <=11.16.0)

directus NPM version =11.0.0, =1.6.3, =20.0.0-rc.0, =34.0.0 - @fahami/directus-pkce 1.0.0 - abcprotocol 0.0.1 Source cves: CVE-2026-35412 Source advisory: OSV:GHSA-QQMV-5P3G-PX89...

@altipla/directus-sdk-utils (0.7.2), @bicou/directus-extension-imagga (>=1.6.3, <=1.6.6) +4 more potentially affected by CVE-2026-35409 via directus (>=11.0.0, <=11.15.4)

directus NPM version =11.0.0, =1.6.3, =20.0.0-rc.0, =33.3.1 - @fahami/directus-pkce 1.0.0 - abcprotocol 0.0.1 Source cves: CVE-2026-35409 Source advisory: SNYK:JS-DIRECTUS-15907610...