CVE-2026-58480

Blocksy Companion Pro

CVE-2026-59800

The CVE-2026-59800 entry describes an OS command injection in 9Router

CVE-2026-20896

CVE-2026-20896 affects Gitea Docker images up to and including 1.26.2. The root cause is the default setting REVERSE_PROXY_TRUSTED_PROXIES=*, which can let an attacker impersonate a user when reverse-proxy authentication headers (e.g., X-WEBAUTH-USER) are enabled. Several sources document this, i...

CVE-2024-58352

Landray OA is affected by an unauthenticated HQL injection through the wechatLoginHelper.do endpoint’s uid parameter. The vulnerability stems from a string-concatenated filter expression passed to Hibernate findList(), enabling attackers to query arbitrary Hibernate entity classes and extract sen...

CVE-2024-14037

CVE-2024-14037 describes an unauthenticated arbitrary file upload vulnerability in Redsea Cloud eHR via the PtFjk.mob servlet endpoint. An attacker can submit a multipart POST containing a JSP webshell disguised with a spoofed image/jpeg Content-Type, bypassing extension/MIME checks, resulting in...

CVE-2026-58455

Dockwatch 0.6.567 is affected by an unauthenticated OS command injection. The flaw arises from a missing exit() after an authentication redirect in loader.php and unsanitized input passed to shell_exec() in ajax/compose.php, allowing an attacker to seed a session flag via an incomplete auth check...

CVE-2026-5524

The Divi Form Builder plugin for WordPress (versions up to and including 5.1.8) is vulnerable to Unauthenticated Arbitrary File Upload leading to Remote Code Execution. The root cause is insufficient file extension validation in the do_image_upload() function where user-supplied input from accept...

CVE-2026-57624

CVE-2026-57624 : Unauthenticated Remote Code Execution in WordPress Blocksy Companion Pro plugin (versions

CVE-2026-13731

CVE-2026-13731 affects the WPBot – AI ChatBot for WordPress plugin (versions up to and including 8.4.9). The vulnerability is a stored Cross‑Site Scripting (XSS) via the conversation parameter caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbi...

CVE-2026-58138

CVE-2026-58138 affects Orkes Conductor 3.21.21 up to, but not including, 3.30.2. The vulnerability arises from unsandboxed GraalVM evaluators built with HostAccess.ALL (or allowAllAccess(true)) used by INLINE, LAMBDA, DO_WHILE, and SWITCH task types, enabling an unauthenticated attacker to submit...

CVE-2026-48282

CVE-2026-48282 affects Adobe ColdFusion 2025.9, 2023.20 and earlier. The connected exploit sources describe a path traversal in ColdFusion’s Remote Development Service (RDS) that allows an unauthenticated attacker to read and write arbitrary files via /CFIDE/main/ide.cfm, resulting in Remote Code...

CVE-2026-8451

CVE-2026-8451 is a memory overread vulnerability in Citrix NetScaler ADC and NetScaler Gateway when configured as a SAML IdP. The issue arises from insufficient input validation, related to the /saml/login path, enabling an unauthenticated attacker to read memory and potentially leak sensitive da...

CVE-2026-56290

CVE-2026-56290 affects Joomla Page Builder CK (com_pagebuilderck). The root cause is an unauthenticated file upload path via browse.ajaxAddPicture that accepts a user-controlled destination with only trivial sanitization and no authentication gate, enabling an attacker to upload PHP/executable fi...

CVE-2026-56011

CVE-2026-56011 describes an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress plugin mapPress Maps for WordPress, affected versions are ≤ 2.97.3. The vulnerability is documented across multiple sources (NVD, CVE databases, and PatchStack) with consistent impact: XSS that c...

CVE-2026-52813

CVE-2026-52813 (Gogs) involves a path traversal flaw in organization names that contain ../ sequences, causing writes to arbitrary filesystem paths. The root cause is insufficient sanitization in internal/database/org.go (and related repo path logic), enabling an attacker to nest Git repositories...

CVE-2026-52806

Gogs is affected by CVE-2026-52806: an authenticated user can trigger remote code execution during the Rebase before merging workflow by crafting a pull request with a malicious base branch name that injects the --exec flag into git rebase. Root cause: the Merge() path in internal/database/pull.g...

CVE-2026-10735

CVE-2026-10735 concerns a supply‑chain compromise of ShapedPlugin Pro plugins (Product Slider Pro for WooCommerce, Real Testimonials Pro, Smart Post Show Pro) delivered via the vendor update server. Technical details show a stage 1 loader in src/Includes/LicenseLoader.php that runs on admin init ...

CVE-2026-55255

Summary of technical details : CVE-2026-55255 is an IDOR in Langflow prior to version 1.9.1 where an authenticated user could trigger a victim’s flow by supplying the victim’s flow UUID to the /api/v1/responses endpoint. The root cause is in get_flow_by_id_or_endpoint_name(), which could load a F...

CVE-2026-28496

CVE-2026-28496 – FOSSBilling SSTI in Twig rendering affects versions prior to 0.8.0. Administrators with access to Twig-rendering features (email templates, mass mail campaigns, custom payment adapters, and the string_render API) can inject Twig expressions, leading to information disclosure and ...

CVE-2026-48908

CVE-2026-48908 affects the Joomla extension SP Page Builder (com_sppagebuilder). Reports and PoCs confirm unauthenticated file upload via the asset.uploadCustomIcon task, allowing arbitrary files to be written to the webroot and potentially executing PHP code. Affected versions are 1.0.0 through ...