399797 matches found
CVE-2026-94545 Satori-generated SVG has improper escaping
Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG markup. The impact depends on how the...
CVE-2026-103397 OpenSave before 2.4.0-beta.1 Authentication Bypass via Spoofed Relay Sender
OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read paired peer identifiers from announcements, and send forged...
CVE-2026-103398 OpenSave through 2.4.0 Arbitrary File Read and Write via Peer-Controlled Save Path
OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes...
CVE-2026-103396 bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount
bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view...
CVE-2026-103270 LightLLM through 1.2.0 Missing Authentication on RL Control Routes
LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pausegeneration, /abortrequest, /flushcache, and /initweightsupdategroup to disrupt inference operations and wedge workers o...
CVE-2026-103395 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service
LightLLM through 1.2.0 visualonly deployments expose an unauthenticated RPyC service with allowpickle enabled that deserializes attacker-supplied arguments in the remoteinferimages method. Attackers can reach the visual RPyC port and pass objects with reduce methods to execute arbitrary code with...
CVE-2026-103243 LightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints
LightLLM through 1.2.0 fails to validate imageurl and audiourl parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply arbitrary URLs to fetch internal resources, with vision model processing disclosing content or error...
CVE-2026-76570 Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1
Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request...
CVE-2026-102984 Astro: Malformed port in the Host header can crash the Node adapter
Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing...
CVE-2026-102983 Astro: Netlify Image CDN allowlist bypass enables SSRF
Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test, ...
CVE-2026-102717 MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash
MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash...
CVE-2026-47097 AJA HELO Plus < 2.1.7 Static AES Passphrase Information Disclosure via /diags
AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware. Attackers can reverse engineer the publicly...
CVE-2026-103227 GPAC DASH Client dash_client.c gf_dash_resolve_url buffer overflow
A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gfdashresolveurl of the file src/mediatools/dashclient.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. Upgrading to version...
CVE-2026-103389 MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph
MISP contains a stored cross-site scripting XSS vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any server-side validation through the galaxy add, edit, and sync/import capture endpoints. The stored value was subsequently concatenated direct...
CVE-2026-103388 MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field
MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTERVALIDATEURL validation. Because FILTERVALIDATEURL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could...
CVE-2026-18782 SQL Injection in Trex Digital Manufacturing's Trex MES
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issue affects Trex MES: through 2026-09-29...
CVE-2026-103226 Artifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow
A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function type1callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicl...
CVE-2026-18783 Missing Server-Side Authentication on REST API Endpoint in Trex Digital Manufacturing's Trex MES
Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Authentication Bypass. This issue affects Trex MES: through 2026-09-29...
CVE-2026-97259 WordPress Pay with Vipps for WooCommerce plugin <= 6.2.4 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4...
CVE-2026-101295 Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction
Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...
CVE-2026-62084 WordPress User Submitted Posts plugin <= 20260810 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jeff Starr User Submitted Posts allows Stored XSS. This issue affects User Submitted Posts: from n/a through 20260810...
CVE-2026-62097 WordPress Business Directory plugin <= 6.4.27 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPTasty Business Directory business-directory-plugin allows Blind SQL Injection.This issue affects Business Directory: from n/a through 6.4.27...
CVE-2026-103222 Blosc C-Blosc2 blosclz Decompression blosclz.c blosclz_decompress integer overflow
A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclzdecompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is...
CVE-2026-93903
LiteSpeed Web Server LSWS before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."...
CVE-2026-103118 GraphicsMagick WPG File wpg.c ExtractPostscript recursion
A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack may be initiated remotely. The patch is...
CVE-2026-82307 Multiple Vulnerabilities in Dolusoft Software's SOPLOG
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection. This issue affects SOPLOG: before Soplog 2026.9.4.1...
CVE-2026-93547 Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells
A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...
CVE-2026-91860 Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge
A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible t...
CVE-2026-76504 Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request,...
CVE-2026-103117 OS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injection
A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function dbproperties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The...
CVE-2026-86778 Username Enumeration in Maksisoft Technology's Maksisoft Gym
Observable response discrepancy vulnerability in Maksisoft Technology, IT, and Software Industry and Trade Inc. Maksisoft Gym allows Account Footprinting. This issue affects Maksisoft Gym: from 0.5.10 before 0.5.11...
CVE-2026-103116 OS4ED openSIS-Classic Student List Search Endpoint GetStuListFnc.php DBQuery sql injection
A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component Student List Search Endpoint. This manipulation of the argument LOsort causes sql injection. The attack can be initiated remotely. The...
CVE-2026-102399 WordPress Photo Gallery by Supsystic plugin <= 1.21.0 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Photo Gallery by Supsystic = 1.21.0 versions...
CVE-2026-102398 WordPress Popup by Supsystic plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Popup by Supsystic = 1.13.1 versions...
CVE-2026-102396 WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Ultimate Maps by Supsystic = 1.5.5 versions...
CVE-2026-102395 WordPress Easy Google Maps plugin <= 1.14.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Easy Google Maps = 1.14.6 versions...
CVE-2026-102386 WordPress WP Photo Album Plus plugin <= 9.3.02.003 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in WP Photo Album Plus = 9.3.02.003 versions...
CVE-2026-102385 WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Ninja Forms = 3.15.3 versions...
CVE-2026-102384 WordPress Supreme Modules Lite plugin <= 2.5.63 - Cross Site Scripting (XSS) vulnerability
Author Cross Site Scripting XSS in Supreme Modules Lite = 2.5.63 versions...
CVE-2026-100513 WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in CF7 Views Complete Entry Management for Contact Form 7 = 3.2.5 versions...
CVE-2026-100508 WordPress Two Factor plugin <= 0.16.0 - Denial of Service Attack vulnerability
Unauthenticated Denial of Service Attack in Two Factor = 0.16.0 versions...
CVE-2026-100507 WordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in If-So Dynamic Content Personalization = 1.10.1 versions...
CVE-2026-97302 WordPress MPG plugin <= 4.2.3 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in MPG = 4.2.3 versions...
CVE-2026-97301 WordPress Cool Formkit Lite plugin <= 2.7.8 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Cool Formkit Lite = 2.7.8 versions...
CVE-2026-97299 WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Razorpay Payment Links for WooCommerce = 2.1.5 versions...
CVE-2026-97298 WordPress King Addons for Elementor plugin <= 51.1.86 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in King Addons for Elementor = 51.1.86 versions...
CVE-2026-97293 WordPress Media LIbrary Assistant plugin <= 3.41 - SQL Injection vulnerability
Contributor SQL Injection in Media LIbrary Assistant = 3.41 versions...
CVE-2026-97292 WordPress YITH WooCommerce Tab Manager plugin <= 2.15.0 - Cross Site Scripting (XSS) vulnerability
Author Cross Site Scripting XSS in YITH WooCommerce Tab Manager = 2.15.0 versions...