Glances - Information Disclosure

Glances 4.5.1 contains an information disclosure vulnerability caused by unfiltered exposure of sensitive configuration data via the /api/4/config REST API endpoint, letting remote attackers access credentials, exploit requires API access. id: CVE-2026-30928 info: name: Glances - Information...

AstrBot <= 4.22.1 - Command Injection

AstrBot versions up to and including 4.22.1 contain a command injection vulnerability in the MCP server configuration endpoint. The /api/tools/mcp/add endpoint accepts arbitrary command and args fields that are passed directly to subprocess execution during the connection test, without any...

Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload

The Quick Playground plugin for WordPress is vulnerable to remote code execution in all versions up to, and including, 1.3.1. The plugin exposes a blueprint REST API endpoint permissioncallback: returntrue that leaks the sync code, and an uploadimage endpoint that accepts file uploads with path...

UniFi OS - Authentication Bypass via Path Traversal (..%2f)

UniFi OS devices contain an improper access control vulnerability caused by insufficient authorization checks, letting network attackers make unauthorized system changes, exploit requires network access. id: CVE-2026-34908 info: name: UniFi OS - Authentication Bypass via Path Traversal ..%2f...

WordPress WP Go Maps < 10.0.10 - Unauthenticated Marker Data Disclosure

WP Go Maps WordPress plugin 10.0.10 contains an information disclosure vulnerability caused by improper enforcement of marker approval filter in admin-ajax fallback for datatables route, letting unauthenticated visitors retrieve unapproved marker records. id: CVE-2026-8385 info: name: WordPress W...

Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload

The Canto plugin for WordPress is vulnerable to missing authorization in the copy-media.php upload flow. The file is directly accessible and accepts attacker-controlled parameters for the upload destination, allowing unauthenticated users to upload arbitrary files constrained to WordPress-allowed...

Progress ShareFile Storage Zones Controller - Authentication Bypass

Customer Managed ShareFile Storage Zones Controller SZC contains an authentication bypass Execution After Redirect that allows unauthenticated attackers to access restricted configuration pages. This leads to changing system configuration and potential remote code execution. id: CVE-2026-2699 inf...

TranslatePress <= 3.3.1 - Unauthenticated Account Takeover

TranslatePress WordPress plugin = 3.3.1 contains a sensitive information exposure caused by the 'trpgettranslationsregular' AJAX action saving password-reset URLs in translation dictionary, letting unauthenticated attackers extract admin password-reset URLs, exploit requires automatic string savi...

W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read

W3 Total Cache WordPress plugin = 2.9.4 contains a directory traversal caused by improper handling in setupSources function, letting unauthenticated attackers read arbitrary files, exploit requires manual minify mode enabled with specific filename. id: CVE-2026-9282 info: name: W3 Total Cache =...

WordPress FluentCRM <= 2.9.87 - Unauthenticated Blind SSRF

FluentCRM WordPress plugin = 2.9.87 contains a blind server-side request forgery caused by improper validation of the 'SubscribeURL' parameter, letting unauthenticated attackers make arbitrary web requests, exploit requires unconfigured SES bounce handling key. id: CVE-2026-7798 info: name:...

9Router <= 0.4.36 - Unauthenticated RCE

9Router = 0.4.36 middleware only guards 8 explicitly listed routes, leaving /api/cli-tools/ and /api/mcp/ entirely unauthenticated. An attacker can POST to /api/cli-tools/cowork-settings to register a custom MCP plugin with attacker-controlled command and args stored verbatim into globalThis, the...

WPvivid Backup & Migration <= 0.9.123 - Arbitrary File Upload

WPvivid Backup & Migration plugin for WordPress = 0.9.123 contains an unauthenticated arbitrary file upload vulnerability caused by improper error handling in RSA decryption and lack of path sanitization, letting unauthenticated attackers upload arbitrary PHP files and achieve remote code executi...

WeGIA < 3.6.5 - Unauthenticated Authentication Bypass via extract()

WeGIA 3.6.5 contains an authentication bypass caused by unsafe use of extract on $REQUEST, letting unauthenticated attackers bypass authentication and access protected areas, exploit requires no authentication. id: CVE-2026-28411 info: name: WeGIA 3.6.5 - Unauthenticated Authentication Bypass via...

LeadConnector < 3.0.22 - Unauthenticated Arbitrary Data Write

LeadConnector WordPress plugin 3.0.22 contains a broken access control caused by missing authorization in a REST route, letting unauthenticated attackers overwrite existing data remotely, exploit requires no authentication. id: CVE-2026-1890 info: name: LeadConnector 3.0.22 - Unauthenticated...

Prodigy Commerce <= 3.3.0 - Local File Inclusion

Prodigy Commerce WordPress plugin = 3.2.9 contains a local file inclusion caused by improper sanitization of 'parameterstemplatename' parameter, letting unauthenticated attackers include and execute arbitrary files remotely. id: CVE-2026-0926 info: name: Prodigy Commerce = 3.3.0 - Local File...

Balbooa Forms < 2.4.1 - Unauthenticated Arbitrary File Upload

Joomla Balbooa Forms contains an unrestricted file upload vulnerability caused by lack of authentication checks, letting unauthenticated attackers upload executable files and achieve remote code execution. id: CVE-2026-56291 info: name: Balbooa Forms 2.4.1 - Unauthenticated Arbitrary File Upload...

Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS

Adminer = 5.4.1 contains a denial of service caused by lack of origin validation in version check endpoint, letting attackers trigger server errors via crafted POST requests, exploit requires no special privileges. id: CVE-2026-25892 info: name: Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent Do...

JoomSport <= 5.7.7 - SQL Injection

The JoomSport WordPress plugin through 5.7.7 is vulnerable to unauthenticated time-based blind SQL injection via the 'sortf' GET parameter in the player list view. The parameter value is backtick-wrapped and directly concatenated into an ORDER BY clause. id: CVE-2026-42647 info: name: JoomSport =...

LiteLLM 1.18.10 - Command Injection

LiteLLM 1.18.10 contains a remote code execution caused by lack of validation of arbitrary command and args in MCP server creation, letting attackers execute OS commands remotely, exploit requires crafted JSON configuration. id: CVE-2026-30623 info: name: LiteLLM 1.18.10 - Command Injection autho...

Arcane <= 1.17.2 - Server-Side Request Forgery

Arcane = 1.17.3 contains an unauthenticated server-side request forgery caused by lack of URL scheme and host validation in /api/templates/fetch endpoint, letting remote attackers perform SSRF, exploit requires no authentication. id: CVE-2026-40242 info: name: Arcane = 1.17.2 - Server-Side Reques...

MajorDoMo - Unauthenticated RCE

MajorDoMo contains a remote code execution caused by an include order bug and lack of exit after redirect in admin panel's PHP console, letting unauthenticated attackers execute arbitrary PHP code via crafted GET requests. id: CVE-2026-27174 info: name: MajorDoMo - Unauthenticated RCE author:...

Vendure Core - SQL Injection

Vendure, an open-source headless commerce platform built on Node.js/TypeScript, contains a critical SQL injection vulnerability in its Shop API. The languageCode query parameter is interpolated directly into a raw SQL CASE expression in ProductService.findOneBySlug without parameterization or inp...

Flowise < 3.1.3 - Remote Code Execution

Flowise prior to 3.1.3 contains a remote code execution vulnerability caused by allowing authenticated users to set arbitrary TypeORM DataSource options including entities that load local JavaScript files, letting authenticated users execute arbitrary code on the server, exploit requires user...

Reposilite >= 3.3.0, < 3.5.12 - Arbitrary File Read

Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version...

Danswer - Insecure Direct Object Reference

The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/fileid interface to view any user's file. id: CVE-2024-9617 info: name: Danswer - Insecure Direct Object Reference author: s4e-io severity: medium...

WordPress Easy Digital Downloads <= 3.2.12 - SQL Injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Easy Digital Downloads allows SQL Injection.This issue affects Easy Digital Downloads: from n/a through 3.2.12. id: CVE-2024-5057 info: name: WordPress Easy Digital Downloads = 3.2.12 - SQL Injecti...

Langflow < 1.7.0 - Path Traversal

Langflow 1.7.1 contains a path traversal caused by insufficient filtering of foldername and filename parameters in downloadprofilepicture endpoint, letting attackers read secretkey across directories, exploit requires crafted request. id: CVE-2026-33497 info: name: Langflow 1.7.0 - Path Traversal...

LightRAG <= 1.5.3 - Credentialed CORS Wildcard

LightRAG = 1.5.4 contains a broken access control vulnerability caused by default CORSORIGINS= with allowcredentials=True in lightragserver.py, letting malicious websites perform authenticated API requests, exploit requires authenticated user. id: CVE-2026-61736 info: name: LightRAG = 1.5.3 -...

AnythingLLM - Username Enumeration via Password Recovery

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to commit e287fab56089cf8fcea9ba579a3ecdeca0daa313, the password recovery endpoint returns different error messages depending on whether a username exists, so enabling...

Gorse < 0.5.10 - Unauthenticated Database Dump

Gorse 0.5.10 contains an authentication bypass caused by empty adminapikey in /api/dump and /api/restore endpoints, letting unauthenticated remote attackers access and modify protected data, exploit requires default empty adminapikey configuration. id: CVE-2026-56782 info: name: Gorse 0.5.10 -...

Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion

The Avada Fusion Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybedeletefiles function. An unauthenticated attacker can delete arbitrary files on the server by manipulating the filepath parameter in the...

MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypass

MLflow 3.15.0 contains an information disclosure vulnerability caused by improper validation of webhook URLs allowing attackers to reach internal or cloud metadata services and obtain response details, exploit requires unauthenticated access to the webhook test endpoint. id: CVE-2026-64849 info:...

Discuz! X5.0 - Authentication Bypass

Discuz! X5.0 20260320 through 20260501 contains an authentication bypass caused by exploitation of a shared cryptographic key and encryption oracle in dbbak.php and loggingctl::loggingmore, letting unauthenticated remote attackers access database backup and restore functions, exploit requires...

MajorDoMo - Cross-Site Scripting

MajorDoMo contains a reflected XSS caused by unsanitized $qry parameter in command.php, letting attackers inject arbitrary JavaScript via crafted URLs, exploit requires victim to visit malicious URL. id: CVE-2026-27176 info: name: MajorDoMo - Cross-Site Scripting author: DhiyaneshDk severity:...

Windmill < 1.603.3 - Operator Authorization Bypass

Windmill versions 1.276.0 through 1.603.2 contain an authorization bypass vulnerability in the folder management API endpoints. The endpoints for creating, deleting, and managing folder ownership do not enforce role-based access control for operator-level users. In Windmill, operators are...

ElementsKit Lite <3.7.9 - Unauthenticated Mailchimp Proxy

The ElementsKit Elementor Addons Lite elementskit-lite plugin for WordPress before 3.7.9 registers the REST route /wp-json/elementskit/v1/widget/mailchimp/subscribe with no authentication or capability check CWE-306. The handler accepts client-supplied Mailchimp API credentials and a list paramet...

Mesop AI Sandbox <= 1.2.2 - Remote Code Execution

Mesop = 1.2.2 contains an unrestricted remote code execution caused by unauthenticated ingestion and execution of base64-encoded Python code in the /exec-py endpoint of ai/testing module, letting attackers execute arbitrary commands on the host, exploit requires HTTP access to the server. id:...

Shield Security <= 21.0.8 - Unauthenticated Reflected XSS

Shield Security WordPress plugin = 21.0.8 contains a reflected cross-site scripting caused by insufficient input sanitization and output escaping in the 'message' parameter, letting unauthenticated attackers inject scripts, exploit requires user interaction. id: CVE-2026-0561 info: name: Shield...

Frappe Framework < 16.15.0 - Arbitrary File Read via render_include Path Traversal

Frappe is a full-stack web application framework. Versions prior to 15.105.0 and 16.15.0 contain a possible Arbitrary File Read vulnerability via Path Traversal. The issue is resolved in versions 16.15.0, 15.105.0 and above. id: CVE-2026-39352 info: name: Frappe Framework 16.15.0 - Arbitrary File...

Concrete CMS <9.5.1 - Unauthenticated File Usage Disclosure

Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller. id: CVE-2026-6826 info: name: Concrete CMS 9.5.1 - Unauthenticated File Usage Disclosure author: str4k3r severity: medium description: | Concrete CMS 9.5.0 and...

Drupal LocalGov Workflows < 1.6.0 - Information Disclosure

Drupal LocalGov Workflows 1.6.0 contains a broken access control vulnerability caused by missing authorization checks, letting attackers perform forceful browsing to access unauthorized resources, exploit requires no special privileges. id: CVE-2026-10768 info: name: Drupal LocalGov Workflows 1.6...

Concrete CMS <= 9.5.0 - Unauthenticated Conversation Message Disclosure (IDOR)

Concrete CMS = 9.5.0 contains an IDOR caused by insufficient access control in /ccm/frontend/conversations/messagedetail endpoint, letting unauthenticated attackers enumerate conversation messages and attachments. id: CVE-2026-8237 info: name: Concrete CMS = 9.5.0 - Unauthenticated Conversation...

GeoServer jsonArrayContains CQL Filter - SQL Injection

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoTools FilterToSqlHelper.constructEquality writes the expected argument of the jsonArrayContains CQL function RAW into the SQL string while only escaping the JSON pointer. A single...

Dockwatch <= 0.6.567 - OS Command Injection

Dockwatch through 0.6.567 contains an unauthenticated command injection caused by missing exit after authentication redirect in loader.php and unsanitized input in ajax/compose.php, letting remote attackers execute arbitrary shell commands, exploit requires seeding a session flag via incomplete...

SquirrelMail Address Add 1.4.2 - Cross-Site Scripting

SquirrelMail Address Add 1.4.2 plugin contains a cross-site scripting vulnerability. It fails to properly sanitize user-supplied input, thus allowing an attacker to execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to...

SAP Web Application Server 6.x/7.0 - Open Redirect

frameset.htm in the BSP runtime in SAP Web Application Server WAS 6.10 through 7.00 allows remote attackers to log users out and redirect them to arbitrary web sites via a close command in the sap-sessioncmd parameter and a URL in the sap-exiturl parameter. id: CVE-2005-3634 info: name: SAP Web...

WordPress Symposium <=15.8.1 - Cross-Site Scripting

WordPress Symposium through 15.8.1 contains a reflected cross-site scripting vulnerability via the wp-content/plugins/wp-symposium/getalbumitem.php?size parameter which allows an attacker to steal cookie-based authentication credentials and launch other attacks. id: CVE-2015-9414 info: name:...

WordPress NewStatPress 0.9.8 - SQL Injection

WordPress NewStatPress 0.9.8 plugin contains a SQL injection vulnerability in includes/nspsearch.php. A remote authenticated user can execute arbitrary SQL commands via the where1 parameter in the nspsearch page to wp-admin/admin.php. id: CVE-2015-4062 info: name: WordPress NewStatPress 0.9.8 - S...

IceWarp Mail Server <11.1.1 - Directory Traversal

IceWarp Mail Server versions prior to 11.1.1 suffer from a directory traversal vulnerability. id: CVE-2015-1503 info: name: IceWarp Mail Server 11.1.1 - Directory Traversal author: 0xAkoko severity: high description: IceWarp Mail Server versions prior to 11.1.1 suffer from a directory traversal...

WordPress Calls to Action <=2.4.3 - Authenticated Reflected XSS

Calls to Action plugin before 2.5.1 for WordPress contains stored XSS caused by unsanitized input in open-tab parameter in wp-admin/edit.php and wp-cta-variation-id parameter in ab-testing-call-to-action-example/, letting remote attackers inject arbitrary web script or HTML, exploit requires...