415509 matches found
CVE-2026-118274 a2ui-project a2ui Binder generic-binder.ts resource consumption
A vulnerability has been found in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unknown functionality of the file renderers/webcore/src/v09/rendering/generic-binder.ts of the component Binder. The manipulation leads to resource consumption. The attack can be initiated remotely. T...
CVE-2026-118273 a2ui-project a2ui data-model.ts DataModel.set resource consumption
A flaw has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the function DataModel.set of the file renderers/webcore/src/v09/state/data-model.ts. Executing a manipulation can lead to resource consumption. It is possible to launch the attack remotely. The exploit has...
CVE-2026-111314 affiliate-toolkit <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parameter
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atkpproductproducturl' parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes i...
CVE-2026-107745 AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the uploadfile function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with...
CVE-2026-109209 All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC
The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customfieldsembedcode' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output...
CVE-2026-97019 AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
CVE-2026-109999 AI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter
The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.2.8 due to insufficient...
CVE-2026-84999 Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler
The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the pieregfileupload function. This is due to the plugin performing file type validation via wpcheckfiletype and wpcheckfiletypeandext but never checking...
CVE-2026-107625 Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userurl' parameter in all versions up to, and including, 2.14.0 due to insufficient input sanitization and...
CVE-2026-109974 All-in-One Video Gallery <= 4.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode Attribute
The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'morelink' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. Th...
CVE-2026-115624
GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts...
CVE-2026-109848
GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the contents of pages without the required read permission and sa...
CVE-2026-105272
GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability, an authenticated attacker may obtain the contents and comments of pages without the required read permission...
CVE-2026-118378 Tabularis before 0.28.0 SQL Injection via MCP describe_table table_name
Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted tablename to the describetable tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument...
CVE-2026-118377 mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks
mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash, letting attackers pos...
CVE-2026-118376 WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses
WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via webfetch or URL-based knowledge import to reach...
CVE-2026-118374 LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response
LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to...
CVE-2026-118375 llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()
llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdmarecv function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack...
CVE-2026-118373 LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host()
LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host discards the OCSP URL scheme and httpalloc only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial...
CVE-2026-118372 LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path
LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host copies the path without rejecting control characters and httpopen places it in the POST request...
CVE-2026-118371 LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line
LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSPsendreqnew and OCSPparseurl functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information...
CVE-2026-118370 libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow...
CVE-2026-117610 libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser
libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2 in lib/xmlparse.c that mishandles the XMLTOKNONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing...
CVE-2026-117609 rtl_433 through 25.12 Stack-Based Buffer Overflow via Proflame 2 Decoder
rtl433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2mc that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a crafted signal file to...
CVE-2026-117608 Assimp through 6.0.5 Heap Out-of-Bounds Read via MD2 Importer Integer Overflow
Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader that allows attackers to bypass frame table bounds checks using crafted header fields. Attackers can supply a malicious .md2 file whose numFrames and numVertices values wrap the 32-bit size check, causi...
CVE-2026-117607 Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import
Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via importlanguage.php containing a .inc file, then request it through the languag...
CVE-2026-117605 nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers
nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product i...
CVE-2026-117606 NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions
NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares usedby with the user. Attackers holding the default nexopos.use.registers permission can submit...
CVE-2015-20129 CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/
CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like...
CVE-2014-125137 C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose...
CVE-2014-125138 C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the pageimage or catimage parameters to the web-accessible /public/image...
CVE-2014-125136 C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backup
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes database backups in the web-accessible /admin/backup directory. Unauthenticated attackers can list the directory or guess date-based names...
CVE-2013-20009 Linksys WAG200G through 1.01.06 Stored XSS via policy_name Parameter
Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policyname parameter in setup.cgi. Attackers can save a malicious policy name from the AccessRes.htm page that executes in administrators' browsers wh...
CVE-2013-20008 Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password
Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the current password. Attackers with access to an authenticated administrator browser session can set a new password to lock out the legitimate...
CVE-2013-20007 Linksys WAG200G through 1.01.06 OS Command Injection via timer_interval in setup.cgi
Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timerinterval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and ru...
CVE-2026-118272 a2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposure
A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/webcore/src/v09/rendering/data-context.ts of the component Error Handler. Performing a manipulation results in information exposure through error...
CVE-2026-106013 Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter
The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verifytwittercallback function because after exchanging the visitor's oauthverifier for their acces...
CVE-2026-118271 a2ui-project a2ui data-context Resolver data-context.ts resource consumption
A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/webcore/src/v09/rendering/data-context.ts of the component data-context Resolver. Such manipulation leads to resource consumption. The attack may be performed from...
CVE-2026-110879 jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)
jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512...
CVE-2026-110747 jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload
ProtobufParser.readStringKey reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks inputPtr + len = inputEnd using signed arithmetic. For values near Integer.MAXVALUE the addition overflows to a negative value and the check passes even when t...
CVE-2026-104895 jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service
The asynchronous Smile parser NonBlockingByteArrayParser uses a raw-binary length prefix taken from untrusted input to allocate a byte before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, decodeVInt computes value 25 != 0 overflow guard present in the...
CVE-2026-104016 jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryError
ProtobufParser parses length-prefixed protobuf string and bytes fields by checking inputPtr + len = inputEnd and then, on the fast path, calling finishShortTextlen. Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAXVALUE, inputPtr +...
CVE-2026-118129 jeremyckahn Chitchatter PostMessage Bootstrap.tsx isConfigMessageEvent improper authentication
A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument parentDomain results in...
CVE-2026-118338
Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-118319
Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-118312
Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-118356
Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-118315
Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-118309
Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...