CVE-2026-19353 DedeCMS Installation Wizard index.php _4_Setup file inclusion

A vulnerability has been found in DedeCMS up to 5.7.118 UTF8SP2. The affected element is the function 4Setup of the file install/index.php of the component Installation Wizard. Such manipulation leads to file inclusion. The attack can be executed remotely. This attack is characterized by high...

CVE-2026-19353

DedeCMS up to 5.7.118 UTF8SP2 contains a vulnerability in the Installation Wizard: the _4_Setup function of install/index.php enables file inclusion. Exploitation is possible remotely and described as high complexity with low privilege requirements (network vector, low impact on confidentiality/i...

CVE-2026-19353: External Control of File Name or Path

A vulnerability has been found in DedeCMS up to 5.7.118 UTF8SP2. The affected element is the function 4Setup of the file install/index.php of the component Installation Wizard. Such manipulation leads to file inclusion. The attack can be executed remotely. This attack is characterized by high...

CVE-2026-64664

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view...

CVE-2026-48054

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file test/test.ts by interpolating user-supplied opts.name ERC20/ERC721 and opts.uri ERC1155 directly into TypeScrip...

CVE-2026-48054 OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file test/test.ts by interpolating user-supplied opts.name ERC20/ERC721 and opts.uri ERC1155 directly into TypeScrip...

CVE-2026-48054 OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file test/test.ts by interpolating user-supplied opts.name ERC20/ERC721 and opts.uri ERC1155 directly into TypeScrip...

@m3s/smart-contract (>=1.1.5, <=2.3.8), @openzeppelin/contracts-mcp (>=0.0.5, <=0.3.0) +11 more potentially affected by CVE-2026-48054 via @openzeppelin/wizard (>=0.1.1, <=0.10.8)

@openzeppelin/wizard NPM version =0.1.1, =1.1.5, =0.0.5, =0.0.1, =1.0.4, =0.0.1, =0.2.48, =0.2.63-a, =1.0.0, =0.0.1, =0.1.2 Source cves: CVE-2026-48054 Source advisory: MEND:CVE-2026-48054...

CVE-2026-48054 OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file test/test.ts by interpolating user-supplied opts.name ERC20/ERC721 and opts.uri ERC1155 directly into TypeScrip...

CVE-2026-48054

OpenZeppelin Contracts Wizard prior to version 0.10.9 is affected by a code injection vulnerability in generated Hardhat/Foundry tests. The root cause is interpolation of user-supplied opts.name and opts.uri directly into TypeScript test files (zip-hardhat.ts:48 and :50) without escaping, enablin...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the user creation wizard endpoint. An attacker can determine if an email address is associated with an existing user by sending requests to this endpoint without having permission to view user information...

EUVD-2026-54231

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view...

PT-2026-68926

Impact An authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belongs to an existing user, without having permission to view users. The endpoint only exposed user existence, not any of its data. Patches This has been...

PT-2026-68769

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.74.1 Statamic versions prior to 6.24.0 Description An authenticated Control Panel user can determine if a specific email address belongs to an existing user by utilizing an endpoint designed for the user creation...

CVE-2026-64664: Exposure of Sensitive Information to an Unauthorized Actor

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view...

CVE-2026-48054: Improper Control of Generation of Code

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file test/test.ts by interpolating user-supplied opts.name ERC20/ERC721 and opts.uri ERC1155 directly into TypeScrip...

vCenter Server or ESXi Host Becomes Unavailable After Its TLS Certificate Is Replaced

Challenge A VMware vSphere server becomes unavailable in Veeam Backup & Replication after the TLS certificate installed on that server has been replaced or renewed. Jobs and other operations that require a connection to that server fail while the server is unavailable. Cause This issue occurs...

CVE-2026-18810 H3C NX15 networkSetup missing authentication

A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads to missing authentication. The attack may be performed from remote. The vendor was contacted early about this disclosure...

CVE-2026-18810

The connected CVE record specifies: affected product is H3C NX15 V100R017; vulnerability exists in the /api/wizard/networkSetup function, where input manipulation leads to missing authentication, enabling remote attack. Reported CVSS scores in the documents indicate high impact (CVSS v3.1 base 7....

PT-2026-67828

Name of the Vulnerable Software and Affected Versions H3C NX15 version V100R017 Description A remote issue exists in the /api/wizard/networkSetup endpoint. Manipulation of an unknown function within this file allows an attacker to bypass authentication. Recommendations At the moment, there is no...