385043 matches found
CVE-2026-18743 Popt-devel: popt-static: short realloc in poptconfigfiletostring
A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to a small memory corruption issue. This occurs because of an error in how the poptConfigFileToString function reallocates memory for buffers...
CVE-2026-19820 Backblaze Client for Windows Improper Link Resolution Vulnerability
A vulnerability in the Backblaze Client allows a local user to make the system not bootable by creating a link from Backblaze's folder to Windows OS system files during a backup. Successful exploitation requires an administrator-level system change that results in the absence of specific Windows ...
CVE-2026-83524 RedPort Optimizer wXa-223 System Clock datetime.php exec command injection
A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimizer wXa-213 and Optimizer wXa-223 up to 20260704. This impacts the function exec of the file /xgatev1/system/datetime.php of the component System Clock. The manipulation leads to command injection. The attack may be...
CVE-2026-82971 QVidium Opera11 CGI Script net_tr.cgi command injection
A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/nettr.cgi of the component CGI Script. This manipulation of the argument ipaddr causes command injection. The attack may be initiated remotely. The exploit has been publicly...
CVE-2026-82957 hyperledger-firefly Webhook Subscription webhooks.go ValidateOptions server-side request forgery
A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptions of the file internal/events/webhooks/webhooks.go of the component Webhook Subscription. Performing a manipulation of the argument url results in server-side request forgery...
CVE-2026-82954 Dokploy Settings application.ts writeTraefikConfigInPath path traversal
A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikConfigInPath of the file packages/server/src/utils/traefik/application.ts of the component Settings. The manipulation of the argument path results in path traversal. The attack can be launched...
CVE-2026-82398 pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/utils.py function readuntilwhitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes...
CVE-2026-82922 ShopEx ECShop flow.php flow_update_cart sql injection
A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects the function flowupdatecart of the file /flow.php?step=updatecart. The manipulation of the argument recid leads to sql injection. The attack can be initiated remotely. The exploit has been disclose...
CVE-2026-82397 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...
CVE-2026-82396 Sulu: Stored XSS via media download inline-disposition override
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php allows the /media/id/download/slug route and its administration variant to honor the inline query parameter for...
CVE-2026-77353 Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos allows authenticated users to inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. Because the input...
CVE-2026-77352 Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user)
Wallos is an open-source, self-hostable personal subscription tracker. From version 2.0.0 to before version 5.0.0, any authenticated Wallos user no admin rights required can make the server open arbitrary outbound SMTP connections to internal/link-local addresses, by setting the SMTP host of thei...
CVE-2026-82395 Sulu: Media move/update authorization bypass (IDOR)
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check from the client-supplied collection value instead of the media item's actual source collection, and...
CVE-2026-82394 Sulu: Fix authorization bypass when creating preview links
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the preview-link endpoint and src/Sulu/Bundle/PreviewBundle/Application/Manager/PreviewLinkManager.php do not enforce VIEW permission for the target resource in...
CVE-2026-77348 Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php`
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable" hardened endpoints/logos/search.php by disabling cURL proxying CURLOPTPROXY = '' + CURLOPTNOPROXY = ''. However...
CVE-2026-82921 ShopEx ECShop pack.php check_img_type unrestricted upload
A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function checkimgtype of the file admin/pack.php. Executing a manipulation of the argument packimg can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been made available to th...
CVE-2026-77351 Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email notification settings, with no server-side SSRF validation...
CVE-2026-82393 pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install
pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for unscoped names. During pnpm install, the unvalidated name...
CVE-2026-82882 Devtron through 2.2.0 Missing Authorization via webhook API token endpoint
Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...
CVE-2026-82392 pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph
pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parsedepPath.name and uses it without validation in deps/graph-builder/src/lockfileToDepGraph.ts and...
CVE-2026-82919 cu silicon edit Endpoint views.py create_app missing authentication
A vulnerability was identified in cu silicon up to 0.1.5. Affected by this vulnerability is the function createapp of the file views.py of the component edit Endpoint. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and...
CVE-2026-62993 Smarty: SSRF via redirect bypass of trusted_uri using {fetch}
Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to 4.5.7 and 5.8.2, depending on the release line, Smarty's fetch handling in libs/plugins/function.fetch.php and src/FunctionHandler/Fetch.php used Security::isTrustedUri to...
CVE-2026-75594 Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling
Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\Cms\Media::thumb to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache...
CVE-2026-61641 Wallos: OIDC account takeover via email-based account linking without `email_verified` check
Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified...
CVE-2026-75592 Kirby: Access to image files outside of the site root via path traversal in the media handling
Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler used incomplete filesystem containment checks in src/Filesystem/Dir.php and src/Filesystem/F.php through Kirby\Filesystem\Dir::realpath and Kirby\Filesystem\F::realpat...
CVE-2026-61640 Wallos: SSRF via OIDC Token/UserInfo URL Configuration
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin-configured OIDC tokenurl and userinfourl in includes/oidc/handleoidccallback.php:18-49 are used directly in curlinit with zero SSRF filtering. Unlike logo/webhook URLs which have...
CVE-2026-83596 Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling...
CVE-2026-71415 Kirby: File upload permissions are not checked during processing of chunk data
Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process before Kirby\Api\Upload::processChunk persisted chunk data. An authenticated...
CVE-2026-82914 kishan0725 Hospital-Management-System search.php sql injection
A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument Contact results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the...
CVE-2026-61639 Wallos: Zip Slip path traversal in database restore writes files to webroot
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo without validating entry names for ../ sequences. Admin uploads crafted zip with entry logos/../../endpoints/shell.php to write webshell to...
CVE-2026-81779 WordPress Newspapers X theme 1.0.46-1.0.48 - Backdoor vulnerability
Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted. This issue affects Newspapers X: from 1.0.46 through 1.0.48...
CVE-2026-61638 Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port. Every other...
CVE-2026-81278 WordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vulnerability
Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1...
CVE-2026-81892 EasyAdmin custom-action dispatcher bypasses access_control on other routes
EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions Action::linkToRoute and MenuItem::linkToRoute, swaps the executed controller based on the...
CVE-2026-82346 HP ImageDiags - Potential Escalation of Privilege
A potential security vulnerability has been identified in the HP ImageDiags for versions prior to 5.0.0.36. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls...
CVE-2026-81891 elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect without passing the result through mimeTypeNormalize. Because the .phtml, .phar, .php5, and .php3 extension...
CVE-2026-54600 Wallos: Unauthenticated database replacement via import endpoint on fresh install
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero fresh/unconfigured install, an unauthenticated attacker can replace the entire database. This issue has...
CVE-2026-82229 WordPress WordPress Social Login and Register plugin <= 7.8.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.2 versions...
CVE-2026-82228 WordPress SiteGround Security plugin <= 1.6.6 - 2FA Bypass vulnerability
Unauthenticated Bypass Vulnerability in SiteGround Security = 1.6.6 versions...
CVE-2026-82225 WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in RegistrationMagic = 6.0.9.8 versions...
CVE-2026-82226 WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...
CVE-2026-82224 WordPress SliceWP plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in SliceWP = 1.2.10 versions...
CVE-2026-81780 WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload in Hash Form = 1.4.2 versions...
CVE-2026-82221 WordPress RegistrationMagic plugin <= 6.0.9.8 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in RegistrationMagic = 6.0.9.8 versions...
CVE-2026-81778 WordPress Kalles Addons plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in Kalles Addons = 1.0.6 versions...
CVE-2026-81765 WordPress Tailored Tools plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Tailored Tools = 3.0.2 versions...
CVE-2026-81768 WordPress Super Store Finder plugin <= 7.10 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Super Store Finder = 7.10 versions...
CVE-2026-81763 WordPress Throws SPAM Away plugin <= 3.8.2 - SQL Injection vulnerability
Unauthenticated SQL Injection in Throws SPAM Away = 3.8.2 versions...