* Update CVE-2026-111497 details and author list
* Uncomment digest line in CVE-2026-111497.yaml
* Update digest line in CVE-2026-111497.yaml
* minor update timeout and request handling in CVE-2026-111497
Reduced INTERIM_TIMEOUT from 5 to 2 seconds and modified the 'attempt' and 'send' functions to use a 'mode' parameter instead of 'probe'. Updated logic for handling streaming and expectations in the request process.
---------
Co-authored-by: Roberto Nunes <[email protected]>
* Add CVE-2026-119495 - Better Search unauthenticated arbitrary post type content disclosure
Better Search before 4.5.3 takes the seamless-mode post_type search argument directly from the request without restricting it to publicly queryable post types (fixed by get_allowed_post_types() in 4.5.3), letting unauthenticated visitors query internal post types such as revisions and disclose draft content through rendered search results. Detection: GET /?s=a&post_type=revision and matching post_type=revision&p= links, which WordPress core get_post_permalink() emits for revision entries rendered by the theme loop. Validated against mock endpoints implementing the diffed 4.5.2/4.5.3 behavior; no live instance available.
* Update CVE-2026-119495.yaml
* Update CVE-2026-119495.yaml
---------
Co-authored-by: maulanawirawan <[email protected]>
Co-authored-by: Aman Rawat <[email protected]>
Co-authored-by: Dhiyaneshwaran <[email protected]>
* Add CVE-2026-120597 - Welcart e-Commerce unauthenticated reflected XSS in ESCOTT error page
Welcart e-Commerce before 2.12.7 reflects the unescaped ResponseCd request parameter in the e-SCOTT settlement error page (esc_html() added in 2.12.7). A plain unauthenticated GET to the cart page with acting_return=1, MerchantFree2=acting_escott_conv and the payload in ResponseCd reaches the sink. Detection: GET /usces-cart/ and /cart/ with those parameters, matching the raw payload reflection that the escaped output no longer contains. Validated against mock endpoints implementing the diffed 2.12.6/2.12.7 behavior; no live instance available.
* Anchor the CVE-2026-120597 matcher to the Welcart error page container
The honeypot check echoes the request URL with decoded query parameters, so a bare reflection matcher matched it. Require the hardcoded error_page_mesage container class alongside the raw reflection; the honeypot response does not contain it, while the vulnerable error page renders it regardless of translation.
* Update CVE-2026-120597.yaml
---------
Co-authored-by: maulanawirawan <[email protected]>
Co-authored-by: Aman Rawat <[email protected]>
* Update atlassian-crowd-panel: match current login title, fix Shodan query and version extractor
### PR Information
- Updated `http/exposed-panels/atlassian-crowd-panel.yaml`
Current Crowd releases (confirmed on 7.2.4) are no longer detected:
- The login title changed to `Atlassian Crowd - Log into Atlassian`. Added it as a second matcher (`or`) next to the legacy title.
- The version moved to the page footer. Relaxed the regex to `Version: ([\d.]+)` so it covers both layouts.
- The shodan-query pointed to Jira. Changed it to `http.component:"atlassian crowd"` and `http.title:"Atlassian Crowd"`.
- Added the `crowd,sso,login` tags.
Path, ID and request count are unchanged.
- References: https://www.atlassian.com/software/crowd
### Template validation
- [x] Validated with a host running a vulnerable version and/or configuration (True Positive)
- [x] Validated with a host running a patched version and/or configuration (avoid False Positive)
#### Additional Details
Before:
```bash
$ nuclei -target "https://crowd.feuerwache-wedel.de" -tags atlassian
[...]
```
After:
```bash
nuclei -target "https://crowd.feuerwache-wedel.de" -tags atlassian
[...]
[atlassian-crowd-panel:version] [http] [info] https://crowd.feuerwache-wedel.de/crowd/console/login.action ["7.2.4"]
```
No matches on Jira, Confluence or generic sites.
* Update atlassian-crowd-panel.yaml
---------
Co-authored-by: Dhiyaneshwaran <[email protected]>
Updated the CVE-2026-12583 entry to clarify the vulnerability details and impact, including the potential for Remote Code Execution. Adjusted matchers and example payloads for better accuracy.
The template matched any Appsmith instance because /api/v1/tenants/current
and /api/v1/consolidated-api/view intentionally stay reachable without
authentication (the login page uses them) and still return a 200 JSON
body after the fix. The fix in appsmithorg/appsmith#41598 (shipped in
v1.98) instead:
- removes instanceId and adminEmailDomainHash from those two responses
for anonymous callers
- makes /api/v1/users/features return 401 for anonymous callers
Split the request so that the first two endpoints only match when one of
the removed fields is present, and /api/v1/users/features only matches
on an unauthenticated 200.
Verified: no match against a patched v1.99 instance (previously matched
on 2 URLs); matches against responses in the pre-fix shape.
Co-authored-by: Claude Fable 5.1 <[email protected]>
* fix(dell-idrac9-detect): require both quoted iDRAC9 keys to avoid matching Apple AirPlay device-info plists
The word matcher matched the substring BuildVersion, which is also
present in osBuildVersion inside Apple AirPlay device-info binary
plists, so any Mac with AirPlay Receiver enabled was detected as a
Dell iDRAC9 (issue #17611). Require both keys quoted exactly as the
iDRAC9 JSON emits them, and drop the stale digest line so the signing
workflow can re-sign on merge.
* Remove condition from Apple AirPlay device-info check
Removed unnecessary condition from device-info check.
* Update dell-idrac9-detect.yaml
---------
Co-authored-by: Roberto Nunes <[email protected]>
Co-authored-by: Dhiyaneshwaran <[email protected]>
* Add CVE-2026-112866 vulnerability details
This YAML file describes a critical SQL injection vulnerability in the Product Filter by WBW plugin for WordPress, detailing the impact, remediation steps, and example requests.
* Update CVE-2026-112866.yaml
* Update CVE-2026-112866.yaml
---------
Co-authored-by: Aman Rawat <[email protected]>
Co-authored-by: Dhiyaneshwaran <[email protected]>
* cisco-meraki-exposure: fix matcher that never matches the current local status page
The template required a rendered sentence that current Meraki firmware
fills in with JavaScript, so it never matched the raw HTML. Match the
page's structural markers instead, and recognise the 307 to the device's
devices.meraki.direct HTTPS status page.
Co-Authored-By: Claude Mythos 5.1 <[email protected]>
* Update cisco-meraki-exposure.yaml
---------
Co-authored-by: Claude Mythos 5.1 <[email protected]>
Co-authored-by: Aman Rawat <[email protected]>
Updated the detection of deprecated SSL/TLS protocols to include SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1. Enhanced remediation steps and added references for better guidance.
Detects if the config page of the Lighter server is exposed, it is an opensource REST application for interacting with Apache Spark on Kubernetes or Apache Hadoop YARN.
The detection matcher is a `type: word` matcher whose word is a regular
expression (`^X-Application-Context:\s*\S.+$`). A word matcher does a
literal substring search, so it looks for those bytes verbatim in the
response headers and is always false. With `matchers-condition: and` the
template never matches, even on a host that sends the X-Application-Context
header.
The intended pattern already exists just below, in the extractor
(`(?m)^X-Application-Context:\s*(\S.+)$`). Fold the status and header
checks into one `type: dsl` matcher that runs that regex against the
response headers and keeps the 200 requirement.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
The template uses the websocket: protocol, not http:, so it does not belong
under http/. This creates websocket/ as the home for websocket-protocol
templates, mirroring how javascript/ and network/ are organised by protocol.
File contents are unchanged.
@@ -38,6 +39,7 @@ Along with the P.O.C following are the required fields in the info section for s
- Make sure to add more than one matcher to prevent false positive results. Avoid short word that could be encountered anywhere
- If possible submit the vulnerable environment based on docker-compose. For example: https://github.com/vulhub/vulhub.
- We only accept templates with complete P.O.Cs instead of just detection based on version
- Keep existing `# digest:` lines intact when updating templates — the repository signing workflow will automatically regenerate signatures upon merge
**Don’t**
@@ -45,6 +47,7 @@ Along with the P.O.C following are the required fields in the info section for s
- Avoid submitting templates with weak matchers. For example: Adding GET/POST data as the matchers in the template, as it can result in false positive results on few hosts
- Don’t make unnecessary changes to the existing templates like adding more requests to the templates when the existing requests or paths are good enough to verify that the bug exists
- Try to keep the requests per template as low as possible
- Don't delete or manually edit the `# digest:` line, and do not sign templates with personal keys
**Best Practices**
@@ -58,6 +61,19 @@ Along with the P.O.C following are the required fields in the info section for s
- We should only upload a web shell as a last resort to validate the vulnerability, and if we do upload a file, make sure the file name is random(`{{randstr}}`)
- Do not include code templates for exploits that can be written using HTTP or JavaScript. We avoid adding additional exploit code to the project unless there is an exception.
### **Template Signing and the `# digest:` Line**
Official templates in this repository include a trailing `# digest:` line (for example, `# digest: 4a0a...:922c...`). This is an automated cryptographic signature and public-key fingerprint used by Nuclei to verify template integrity and authenticity.
- **What it is**: It is an automated signature marker generated by ProjectDiscovery, not a comment or obsolete metadata.
- **Do not edit or delete it**: When updating existing templates, leave the existing `# digest:` line as-is. Do not hand-edit or remove it.
- **Automated Signing**: When a pull request is merged into `main`, the automated **Template Sign** workflow automatically calculates and updates the signature for all modified templates using ProjectDiscovery's official signing key.
- **New Templates**: New templates should be submitted without any `# digest:` line. They will be signed automatically upon merge.
- **Do not sign with personal keys**: Never sign contributed templates with your own private key. Specifically, `code` and `javascript` templates signed with non-ProjectDiscovery keys will fail CI validation (`Signing Key Check`) because Nuclei restricts re-signing code protocol templates for security reasons.
- **Signature verification at scan time**:
- For standard protocols (`http`, `dns`, `network`, etc.), Nuclei verifies signatures against trusted keys and displays a warning if a template is unsigned or modified.
- For `code` and `javascript` protocols, valid signatures from trusted keys are mandatory for security. Nuclei will refuse to execute untrusted or improperly signed code templates by default.
- "contains_all(stderr, 'read tcp', 'i/o timeout') && !contains(stderr, 'websocket: close 1002 (protocol error): An invalid WebSocket frame was received - the most significant bit of a 64-bit payload was illegally set')"
{"ID":"CVE-2023-31478","Info":{"Name":"GL.iNET SSID Key Disclosure","Severity":"high","Description":"An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-31478.yaml"}
{"ID":"CVE-2023-31548","Info":{"Name":"ChurchCRM v4.5.3 - Cross-Site Scripting","Severity":"medium","Description":"A stored Cross-site scripting (XSS) vulnerability in the FundRaiserEditor.php component of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2023/CVE-2023-31548.yaml"}
{"ID":"CVE-2023-3169","Info":{"Name":"tagDiv Composer \u003c 4.2 - Stored Cross-Site Scripting","Severity":"high","Description":"tagDiv Composer plugin versions before 4.2 for WordPress are vulnerable to unauthenticated stored XSS via the /wp-json/tdw/save_css endpoint. An attacker can inject malicious JavaScript code through the compiled_css parameter, which gets stored and executed when the CSS is loaded.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-3169.yaml"}
{"ID":"CVE-2023-31719","Info":{"Name":"FUXA \u003c= 1.1.12 - Unauthenticated SQL Injection","Severity":"critical","Description":"FUXA \u003c= 1.1.12 contains a SQL injection caused by unsanitized input in /api/signin, letting attackers execute arbitrary SQL commands, exploit requires sending crafted input to the endpoint.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-31719.yaml"}
{"ID":"CVE-2023-3188","Info":{"Name":"Owncast - Server Side Request Forgery","Severity":"medium","Description":"Server-Side Request Forgery (SSRF) in GitHub repository owncast/owncast prior to 0.1.0.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2023/CVE-2023-3188.yaml"}
{"ID":"CVE-2023-3197","Info":{"Name":"WordPress MStore API \u003c= 4.0.1 - Unauthenticated SQL Injection","Severity":"critical","Description":"MStore API plugin for WordPress up to version 4.0.1 contains an unauthenticated blind SQL injection caused by insufficient escaping of 'id' parameter in SQL queries, letting attackers execute arbitrary SQL commands without authentication, exploit requires sending crafted requests with malicious 'id' parameter.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2023/CVE-2023-3197.yaml"}
{"ID":"CVE-2023-32068","Info":{"Name":"XWiki - Open Redirect","Severity":"medium","Description":"XWiki Platform is vulnerable to open redirect attacks due to improper validation of the xredirect parameter. This allows an attacker to redirect users to an arbitrary website. The vulnerability is patched in versions 14.10.4 and 15.0.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-32068.yaml"}
@@ -2859,6 +2860,7 @@
{"ID":"CVE-2023-5244","Info":{"Name":"Microweber \u003c V.2.0 - Cross-Site Scripting","Severity":"medium","Description":"Reflected Cross-Site Scripting Vulnerability in types GET parameter on the /editor_tools/rte_image_editor endpoint.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-5244.yaml"}
{"ID":"CVE-2023-5360","Info":{"Name":"WordPress Royal Elementor Addons Plugin \u003c= 1.3.78 - Arbitrary File Upload","Severity":"critical","Description":"Arbitrary File Upload vulnerability in WordPress Royal Elementor Addons Plugin. This could allow a malicious actor to upload any type of file to your website. This can include backdoors which are then executed to gain further access to your website. This vulnerability has been fixed in version 1.3.79\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-5360.yaml"}
{"ID":"CVE-2023-5375","Info":{"Name":"Mosparo \u003c 1.0.2 - Open Redirect","Severity":"medium","Description":"Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-5375.yaml"}
{"ID":"CVE-2023-54335","Info":{"Name":"eXtplorer \u003c= 2.1.14 - Authentication Bypass","Severity":"critical","Description":"eXtplorer \u003c= 2.1.14 contains an authentication bypass in ext_find_user() (include/users.php). When the `password` POST field is omitted entirely, the password is NULL and the function returns the matching user record without checking any password. With the default \"admin\" account, an unauthenticated attacker can log in as administrator.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-54335.yaml"}
{"ID":"CVE-2023-54391","Info":{"Name":"Proxmox VE - Default Credentials with TFA Bypass","Severity":"critical","Description":"Detected Proxmox VE was accessible using default root@pam credentials combined with a TFA challenge bypass. An attacker could authenticate as root by submitting the default password \"root@pam\" along with a crafted tfa-challenge parameter, thereby bypassing two-factor authentication enforcement and gaining full administrative access to the hypervisor management interface.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2023/CVE-2023-54391.yaml"}
{"ID":"CVE-2023-5556","Info":{"Name":"Structurizr on-premises - Cross Site Scripting","Severity":"medium","Description":"Cross-site Scripting (XSS) - Reflected in GitHub repository structurizr/onpremises prior to 3194.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-5556.yaml"}
{"ID":"CVE-2023-5558","Info":{"Name":"LearnPress \u003c 4.2.5.5 - Cross-Site Scripting","Severity":"medium","Description":"The LearnPress WordPress plugin before 4.2.5.5 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-5558.yaml"}
@@ -3403,6 +3405,7 @@
{"ID":"CVE-2024-56325","Info":{"Name":"Apache Pinot \u003c 1.3.0 - Authentication Bypass","Severity":"critical","Description":"This vulnerability allows remote attackers to bypass authentication on affected installations of Apache Pinot. Authentication is not required to exploit this vulnerability.The specific flaw exists within the AuthenticationFilter class. The issue results from insufficient neutralization of special characters in a URI. An attacker can leverage this vulnerability to bypass authentication on the system.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-56325.yaml"}
{"ID":"CVE-2024-56511","Info":{"Name":"DataEase \u003c 2.10.4 - Authentication Bypass via Whitelist Path Traversal","Severity":"critical","Description":"DataEase versions up to and including 2.10.3 contain an authentication bypass in `io.dataease.auth.filter.TokenFilter`. The filter passes the raw, unnormalized request URI to `WhitelistUtils.match()`, which only checks for whitelisted prefixes such as `/geo/`, `/customGeo/`, `/map/`, `/oauth2/`, and `/websocket` without resolving `..` segments. By prepending a whitelisted prefix and traversing back into the configured `server.servlet.context-path`, an attacker bypasses the filter while Tomcat still routes the request to the genuine, protected controller. This collapses the entire `/de2api` surface (user management, datasources, dashboards, exports) into unauthenticated access.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-56511.yaml"}
{"ID":"CVE-2024-56512","Info":{"Name":"Apache NiFi - Information Disclosure","Severity":"medium","Description":"Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to a Parameter Context, but in cases where the Process Group did not reference any Parameter values, the framework did not check user authorization for the bound Parameter Context. Missing authorization for a bound Parameter Context enabled clients to download non-sensitive Parameter values after creating the Process Group.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-56512.yaml"}
{"ID":"CVE-2024-56829","Info":{"Name":"Huang Yaoshi Pharmaceutical Management Software - Unrestricted File Upload","Severity":"critical","Description":"Huang Yaoshi Pharmaceutical Management Software up to 16.0 contains an unrestricted file upload caused by accepting .asp filenames in the UploadFile element of a SOAP request to /XSDService.asmx, letting attackers upload arbitrary files, exploit requires sending a crafted SOAP request.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-56829.yaml"}
{"ID":"CVE-2024-57045","Info":{"Name":"D-Link DIR-859 - Information Disclosure","Severity":"critical","Description":"A critical information disclosure vulnerability exists in D-Link devices where sensitive device account information including credentials can be retrieved by sending an unauthenticated request to `/getcfg.php` endpoint with the parameter `SERVICES=DEVICE.ACCOUNT`. This could allow attackers to obtain administrative credentials and gain full control of the affected device.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-57045.yaml"}
{"ID":"CVE-2024-57046","Info":{"Name":"Netgear DGN2200 - Improper Authentication","Severity":"high","Description":"A vulnerability in the Netgear DGN2200 router with firmware version v1.0.0.46 and earlier permits unauthorized individuals to bypass the authentication. When adding \"?x=1.gif\" to the requested url, it will be recognized as passing the authentication.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2024/CVE-2024-57046.yaml"}
{"ID":"CVE-2024-57049","Info":{"Name":"TP-Link Archer C20 - Authentication Bypass","Severity":"critical","Description":"A vulnerability in the TP-Link Archer C20 router with firmware version V6.6_230412 and earlier permits unauthorized individuals to bypass authentication on interfaces under the /cgi directory. When adding a Referer header with value \"http://tplinkwifi.net\" to requests, the router will recognize the request as passing authentication, allowing access to protected administration interfaces.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-57049.yaml"}
@@ -3954,23 +3957,57 @@
{"ID":"CVE-2026-0770","Info":{"Name":"Langflow \u003c 1.3.0 - Remote Code Execution via validate_code() exec()","Severity":"critical","Description":"Langflow contains a remote code execution caused by inclusion of functionality from untrusted control sphere in the exec_globals parameter at the validate endpoint, letting remote attackers execute arbitrary code as root, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-0770.yaml"}
{"ID":"CVE-2026-0829","Info":{"Name":"Frontend File Manager Plugin \u003c= 23.5 - Unauthenticated Arbitrary Email Sending","Severity":"high","Description":"Frontend File Manager Plugin WordPress plugin through 23.5 contains an open relay and unauthorized file access vulnerability caused by lack of authentication and security checks, letting unauthenticated attackers send emails and access files, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-0829.yaml"}
{"ID":"CVE-2026-0926","Info":{"Name":"Prodigy Commerce \u003c= 3.3.0 - Local File Inclusion","Severity":"critical","Description":"Prodigy Commerce WordPress plugin \u003c= 3.2.9 contains a local file inclusion caused by improper sanitization of 'parameters[template_name]' parameter, letting unauthenticated attackers include and execute arbitrary files remotely.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-0926.yaml"}
{"ID":"CVE-2026-102764","Info":{"Name":"BeyondTrust Remote Support \u003c= 26.2.3 - Origin Validation File Upload","Severity":"critical","Description":"The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-102764.yaml"}
{"ID":"CVE-2026-102782","Info":{"Name":"OrdaSoft Simple Membership \u003c 7.4.0 - SQL Injection","Severity":"critical","Description":"OrdaSoft Simple Membership (com_simplemembership) for Joomla before 7.4.0 is vulnerable to unauthenticated SQL injection via the 'login' parameter of the checkLoginPass task (site/simplemembership.php). The handler passes the value through Joomla's generic input filter, which strips HTML but leaves quotes and SQL syntax intact, and concatenates it directly into the SQL query with no escaping or parameter binding. Error-based injection via extractvalue() lets unauthenticated attackers exfiltrate database contents.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-102782.yaml"}
{"ID":"CVE-2026-102878","Info":{"Name":"mcp-chrome-bridge (hangwin/mcp-chrome) \u003c= 1.0.31 - CORS Origin Bypass (CSWSH)","Severity":"high","Description":"mcp-chrome-bridge \u003c=1.0.31 uses origin.startsWith for CORS, so origins like http://127.0.0.1.evil.com are wrongly allowed, letting attackers bypass CORS and access the local server.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2026/CVE-2026-102878.yaml"}
{"ID":"CVE-2026-103956","Info":{"Name":"Loom for AWS \u003c 1.6.1 - Unauthenticated Super-Admin Access","Severity":"critical","Description":"Loom for AWS \u003c 1.6.1 contains a broken authentication caused by missing authentication for critical functions in the authentication dependency, letting remote actors obtain super-admin authority over the agent control plane, exploit requires no identity provider configured.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2026/CVE-2026-103956.yaml"}
{"ID":"CVE-2026-104736","Info":{"Name":"LearnPress \u003c= 4.4.9.1 - PHP Object Injection","Severity":"critical","Description":"LearnPress WordPress plugin \u003c= 4.4.10 contains a PHP Object Injection caused by deserialization of untrusted 'checkout-email' parameter in checkout AJAX action, letting unauthenticated attackers inject PHP objects remotely.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-104736.yaml"}
{"ID":"CVE-2026-104935","Info":{"Name":"Ivanti Connect Secure \u003c= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH Header","Severity":"critical","Description":"Ivanti Connect Secure VPN appliances contain an authentication bypass vulnerability in how the appliance routes requests from front- and back-end processes to CGI script handlers. The URL path is used to determine whether a request is allowed (welcome.cgi is public), while the X-DSCGI-PATH header determines the actual destination of the request. An attacker can send a request to the unauthenticated welcome.cgi endpoint with an X-DSCGI-PATH header pointing to an authenticated CGI script such as wu.cgi, bypassing authentication entirely. This vulnerability is chained with a file write race condition in wu.cgi and a privilege escalation via dsinvoked DSCache trust to achieve unauthenticated root-level remote code execution.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-104935.yaml"}
{"ID":"CVE-2026-105133","Info":{"Name":"AhsayCBS - JSON API Authentication Bypass","Severity":"medium","Description":"Ahsay AhsayCBS \u003c= 10.3.2 contains an authentication bypass caused by manipulation of the \"random\" argument in checkSysPwd function of API component, letting remote attackers bypass authentication, exploit requires crafted argument manipulation.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2026/CVE-2026-105133.yaml"}
{"ID":"CVE-2026-105134","Info":{"Name":"AhsayCBS \u003c= 10.3.4 - Unauthenticated RCE","Severity":"critical","Description":"Ahsay AhsayCBS \u003c= 10.3.2 contains a command injection caused by manipulation of the \\\"random\\\" argument in /rps/api/json/UpdateReceivers.do of Replication Receiver, letting remote attackers execute OS commands, exploit requires crafted request\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-105134.yaml"}
{"ID":"CVE-2026-10520","Info":{"Name":"Ivanti Sentry - OS Command Injection","Severity":"critical","Description":"An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-10520.yaml"}
{"ID":"CVE-2026-10525","Info":{"Name":"NEX-Forms Express WP Form Builder \u003c 9.2.3 - Unauthenticated Stored XSS","Severity":"high","Description":"NEX-Forms Express WP Form Builder plugin for WordPress before 9.2.3 is vulnerable to unauthenticated stored Cross-Site Scripting. The plugin registers a wp_ajax_nopriv_submit_nex_form handler for form submissions. Array-type field values are processed through rest_sanitize_array(), which only reindexes the array and performs no HTML sanitization, so markup is stored verbatim. When an administrator views the submitted entries, the stored payload renders without esc_html() escaping and executes arbitrary JavaScript in the admin's browser. Scalar fields are not affected (they are passed through strip_tags()).\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-10525.yaml"}
{"ID":"CVE-2026-105740","Info":{"Name":"Langflow 1.8.3 and 1.9.0 - Authenticated MCP Stdio Command Execution","Severity":"critical","Description":"An authenticated user can register an MCP stdio server command that executes\nwhen Langflow lists server actions. The 1.9.0 REST validation can be bypassed\nby placing arguments in the command field. This probe runs a short Python\ncallback, verifies an out-of-band DNS lookup, and removes its server config.\nThe equivalent sink is hardened in 1.10.3.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2026/CVE-2026-105740.yaml"}
{"ID":"CVE-2026-10580","Info":{"Name":"Hippoo Mobile App for WooCommerce \u003c= 1.9.4 - Authentication Bypass to Admin Account Takeover","Severity":"critical","Description":"Hippoo Mobile App for WooCommerce WordPress plugin \u003c= 1.9.4 contains an authentication bypass caused by logic conflation in user permission checks, letting unauthenticated attackers take over administrator accounts via REST API password reset.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-10580.yaml"}
{"ID":"CVE-2026-10768","Info":{"Name":"Drupal LocalGov Workflows \u003c 1.6.0 - Information Disclosure","Severity":"high","Description":"Drupal LocalGov Workflows \u003c 1.6.0 contains a broken access control vulnerability caused by missing authorization checks, letting attackers perform forceful browsing to access unauthorized resources, exploit requires no special privileges.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-10768.yaml"}
{"ID":"CVE-2026-108123","Info":{"Name":"WP Booking System \u003c= 2.1.0.3 - Unauthenticated Email Log Disclosure","Severity":"high","Description":"WP Booking System – Booking Calendar plugin for WordPress \u003c= 2.1.0.3 contains an authorization bypass caused by improper user authorization verification, letting unauthenticated attackers read stored notification emails exposing customer PII, exploit requires authenticated Subscriber-level user.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-108123.yaml"}
{"ID":"CVE-2026-10818","Info":{"Name":"WPForms Pro \u003c= 1.10.1.1 - Unauthenticated Arbitrary File Upload","Severity":"high","Description":"WPForms Pro for WordPress up to and including 1.10.1.1 allows unauthenticated arbitrary file upload. The wpforms_upload_chunk_init, wpforms_upload_chunk and wpforms_file_chunks_uploaded AJAX actions are registered for unauthenticated visitors without a nonce check, and raw chunk bytes are written under wp-content/uploads/wpforms/tmp/ before file extension and MIME type validation happens, so a rejected upload never removes the already written file. An unauthenticated attacker can plant arbitrary files and, depending on server configuration, achieve remote code execution.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2026/CVE-2026-10818.yaml"}
{"ID":"CVE-2026-10823","Info":{"Name":"YMC Filter WordPress - Unauthenticated Post Disclosure","Severity":"high","Description":"YMC Filter WordPress plugin \u003c 3.11.3 contains a broken access control vulnerability caused by improper authorization and lack of validation in a REST API endpoint, letting unauthenticated attackers retrieve private and non-public post content, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-10823.yaml"}
{"ID":"CVE-2026-108578","Info":{"Name":"Neterbit NW-431F - Unauthenticated SMS Disclosure","Severity":"medium","Description":"Neterbit NW-431F 20250715 contains an information disclosure vulnerability caused by manipulation in /sms.json of the Embedded Web Server, letting remote attackers access sensitive information, exploit requires no special conditions.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-108578.yaml"}
{"ID":"CVE-2026-109618","Info":{"Name":"PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Active Crash Detection","Severity":"critical","Description":"PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).\n","Classification":{"CVSSScore":"9.2"}},"file_path":"http/cves/2026/CVE-2026-109618.yaml"}
{"ID":"CVE-2026-109619","Info":{"Name":"PHP 8.2 \u003c 8.2.35, 8.3 \u003c 8.3.36, 8.4 \u003c 8.4.27, 8.5 \u003c 8.5.12 - Use-After-Free Remote Code Execution","Severity":"critical","Description":"PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12 contain a use-after-free caused by request-owned global state that is not reset before the request heap is freed, letting unauthenticated attackers execute arbitrary code in a subsequent request handled by the same worker; exploitation requires a crafted request sequence and a reachable session or INI consumer.\nThis template performs a passive version check against the PHP version disclosed in the X-Powered-By or Server response header and does not send a crafted request. It follows same-origin redirects (same host and port); redirects to another origin are ignored so a third-party response cannot be attributed to the scanned host. Limitations: detection requires the version to be exposed, so hosts with expose_php=Off and no PHP version in the Server header, hosts behind a proxy or FastCGI configuration that strips these headers, and applications that override them are not detected. These headers can also be spoofed, so a match is only as trustworthy as the disclosed header. Builds that backport the fix while keeping the upstream version number (for example 8.2.34-1ubuntu1) still match, so a match reports an affected upstream version rather than confirmed exploitability. Pre-release or development builds of a fixed version (for example 8.2.35RC1) and responses that advertise conflicting versions in different headers are not matched.\n","Classification":{"CVSSScore":"9.2"}},"file_path":"http/cves/2026/CVE-2026-109619.yaml"}
{"ID":"CVE-2026-110372","Info":{"Name":"WordPress OttoKit Plugin \u003c= 1.1.40 - Unauthenticated Privilege Escalation via connection-denied Token","Severity":"critical","Description":"OttoKit (formerly SureTriggers) WordPress plugin \u003c= 1.1.40 unauthenticated privilege escalation. When an admin denies the OttoKit SaaS connection, the plugin stores the fixed public string 'connection-denied' as the site API secret. The RestController::autheticate_user permission callback reads the 'st_authorization' request header, strips a 'Bearer ' prefix via sscanf($token,'Bearer %s'), then hash_equals() it against the stored secret. An attacker who sends 'st-authorization: Bearer connection-denied' is authenticated to the automation REST API and can create administrator accounts. Fixed in 1.1.41.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-110372.yaml"}
{"ID":"CVE-2026-110447","Info":{"Name":"Collabora Built-in CODE Server \u003c 26.4.303 - OS Command Injection","Severity":"critical","Description":"Collabora Online Built-in CODE Server before 26.4.303 contains a command injection caused by improper handling in proxy.php when the CODE server is not running, letting remote attackers execute OS commands, exploit requires CODE server to be stopped.\n","Classification":{"CVSSScore":"9.2"}},"file_path":"http/cves/2026/CVE-2026-110447.yaml"}
{"ID":"CVE-2026-1115","Info":{"Name":"parisneo/lollms \u003c 2.2.0 - Authenticated Stored XSS","Severity":"high","Description":"parisneo/lollms \u003c 2.2.0 contains a stored XSS caused by unsanitized user input in create_post function in backend/routers/social/__init__.py, letting attackers inject malicious scripts executed in user browsers, exploit requires crafted post submission.\n","Classification":{"CVSSScore":"9.0"}},"file_path":"http/cves/2026/CVE-2026-1115.yaml"}
{"ID":"CVE-2026-112866","Info":{"Name":"Product Filter by WBW \u003c= 3.4.6 - SQL Injection","Severity":"critical","Description":"WPFactory Product Filter by WBW woo-product-filter \u003c= 3.4.6 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-112866.yaml"}
{"ID":"CVE-2026-11387","Info":{"Name":"SMS Alert – SMS \u0026 OTP for WooCommerce - Privilege Escalation","Severity":"critical","Description":"The SMS Alert – SMS \u0026 OTP for WooCommerce, Order Notifications \u0026 Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.9.5. This is due to the plugin not properly validating a user's identity prior to updating their details like reset the password of any user account, including administrators, and gain full access to those accounts. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. This is only vulnerable on sites with OTP verification for password resets enabled, and where the administrator (or other user) has set a phone number for OTP verification.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-11387.yaml"}
{"ID":"CVE-2026-114509","Info":{"Name":"Laravel TokenGuard - Authentication Bypass","Severity":"critical","Description":"Laravel's TokenGuard (driver =\u003e token, hash =\u003e false) does not validate the\ncredential type before the database lookup. Sending a JSON body with\napi_token as an array of integers ({\"api_token\":[0]}) produces a\nwhereIn('api_token', [0]) query; under MySQL/MariaDB implicit casting,\nevery varchar token not starting with a digit evaluates to 0, so the first\nuser row is returned to an unauthenticated attacker.\n","Classification":{"CVSSScore":"9.2"}},"file_path":"http/cves/2026/CVE-2026-114509.yaml"}
{"ID":"CVE-2026-115574","Info":{"Name":"Zulip Server 11.0 - 12.1 - Unauthenticated Custom Profile Field Disclosure","Severity":"medium","Description":"Zulip 11.0 to 12.1 contains an information disclosure caused by missing access-control check in GET /json/users endpoint, letting unauthenticated spectators access all users' custom profile fields, exploit requires web-public channels enabled.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-115574.yaml"}
{"ID":"CVE-2026-11565","Info":{"Name":"WordPress Advanced File Manager \u003c 5.4.13 - Arbitrary File Read","Severity":"high","Description":"The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access (as low as Subscriber) to read arbitrary files on the server.\n","Classification":{"CVSSScore":"8.5"}},"file_path":"http/cves/2026/CVE-2026-11565.yaml"}
{"ID":"CVE-2026-115886","Info":{"Name":"MLflow \u003c3.17.0 - Unauthenticated SSRF via Third-Party (TruLens) Scorer","Severity":"medium","Description":"MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, the scorer invoke, register, and GenAI evaluate endpoints, including unauthenticated POST /ajax-api/3.0/mlflow/scorer/invoke, accept serialized third-party scorer data that Scorer.model_validate_json resolves using a module-path allowlist without constraining the selected class or its constructor arguments. When optional trulens and trulens-providers-litellm packages are installed, an attacker can select mlflow.genai.scorers.trulens, choose a model URI outside MLflow's native provider registry so execution uses the LiteLLM fallback, and supply api_base and api_key values that cause the server to send an outbound request to an attacker-chosen or internal host with attacker-controlled headers and body. The vulnerable deserialization occurs before a tracking-store lookup or job submission.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2026/CVE-2026-115886.yaml"}
{"ID":"CVE-2026-116006","Info":{"Name":"Ruoyi-Vue-Pro - Unauthenticated Admin Takeover via Predictable SMS Code","Severity":"critical","Description":"ruoyi-vue-pro (Yudao) ships base configuration yudao.sms-code.begin-code=end-code=9999, so every generated SMS verification code is the constant \"9999\" in all profiles. The anonymous SMS-login flow therefore grants an access token to any account whose mobile number is known: send-sms-code followed by sms-login with code 9999 issues a full token, including for the seeded super administrator account (mobile 18818260272 in the shipped SQL). No CAPTCHA hook exists for scene=21 in any profile.\n","Classification":{"CVSSScore":"9.2"}},"file_path":"http/cves/2026/CVE-2026-116006.yaml"}
{"ID":"CVE-2026-116067","Info":{"Name":"Paisa \u003c 0.7.8 - Unauthenticated Path Traversal","Severity":"high","Description":"Paisa \u003c 0.7.8 contains a path traversal vulnerability caused by improper sanitization of file names in GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers, letting unauthenticated attackers read arbitrary files and delete backups via ../ sequences.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-116067.yaml"}
{"ID":"CVE-2026-116070","Info":{"Name":"Docker-Proxy hubcmdui - Missing Authentication on /api/config","Severity":"medium","Description":"Docker-Proxy through 5.1.9 exposes the hubcmdui configuration endpoint /api/config without authentication. An unauthenticated remote attacker can read the full server configuration, including the WeChat/Telegram monitoring webhook URLs and bot token inside monitoringConfig, the menuItems structure and docker host settings, and can overwrite configuration via the unauthenticated POST handler. The fix restricts anonymous callers to a public subset (theme, language, logo, proxyDomain).\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2026/CVE-2026-116070.yaml"}
{"ID":"CVE-2026-116167","Info":{"Name":"SiYuan 2.9.0-3.8.6 - Unauthenticated XSS via check-auth \"to\" Parameter","Severity":"high","Description":"SiYuan 2.9.0 through 3.8.6 serves the unauthenticated /check-auth authorization page (app/stage/auth.html) with a script that assigns the `to` query parameter to window.location.href without scheme validation. A crafted link whose `to` value is a javascript: URI executes script in the kernel origin once the victim completes authentication on that page.\n","Classification":{"CVSSScore":"7.6"}},"file_path":"http/cves/2026/CVE-2026-116167.yaml"}
{"ID":"CVE-2026-116205","Info":{"Name":"YesWiki \u003c 4.7.0 - Unauthenticated Server-Side Request Forgery","Severity":"high","Description":"YesWiki \u003c 4.7.0 contains an unauthenticated server-side request forgery caused by improper handling of [[|URL]] wiki syntax in the render handler, letting remote attackers fetch arbitrary URLs, exploit requires no authentication.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-116205.yaml"}
{"ID":"CVE-2026-116366","Info":{"Name":"ClickHouse Server - Brotli v1.2.0 Decoder DoS/OOB-Write","Severity":"critical","Description":"ClickHouse Server contains a remote code execution vulnerability caused by improper access control, letting unauthenticated users with network access execute arbitrary code remotely, exploit requires network access.\n","Classification":{"CVSSScore":"9.5"}},"file_path":"http/cves/2026/CVE-2026-116366.yaml"}
{"ID":"CVE-2026-116485","Info":{"Name":"danmu_api - Unauthenticated Access to Admin API via Default Token","Severity":"high","Description":"danmu_api before 1.21.7 contains an authentication bypass caused by default TOKEN usage and unset ADMIN_TOKEN, letting unauthenticated attackers modify server environment configuration via specific API endpoints, exploit requires default token configuration.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-116485.yaml"}
{"ID":"CVE-2026-116548","Info":{"Name":"VikRentCar \u003c= 1.4.10 - Cross-Site Scripting","Severity":"high","Description":"The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'optionals' parameter in all versions up to, and including, 1.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2026/CVE-2026-116548.yaml"}
{"ID":"CVE-2026-116690","Info":{"Name":"MLflow 3.10.0-3.16.1 - Arbitrary File Read","Severity":"high","Description":"MLflow 3.10.0 through 3.16.1 contains a path traversal in the prompt branch of the CreateModelVersion handler. The fix for CVE-2026-2614 only validated prompt sources that carry a URL scheme, so a schemeless relative path such as ../../../etc is stored unchanged as the model version artifact location and later served by the model-versions/get-artifact endpoint, letting unauthenticated remote attackers read arbitrary files from the server filesystem.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-116690.yaml"}
{"ID":"CVE-2026-116748","Info":{"Name":"Transmission 4.0.0-4.1.2 - Permissive CORS Exposes RPC Session ID","Severity":"medium","Description":"Transmission 4.0.0 through 4.1.2 sends Access-Control-Allow-Origin: * on RPC responses and advertises X-Transmission-Session-Id via Access-Control-Expose-Headers on the 409 session handshake. Any website a user visits can read the session-id nonce that guards against CSRF, enabling cross-origin control of the daemon's RPC API.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-116748.yaml"}
{"ID":"CVE-2026-116817","Info":{"Name":"OpenPanel - Unauthenticated Bull Board Queue Dashboard","Severity":"medium","Description":"OpenPanel before 3.0.0 contains a broken authentication vulnerability caused by missing authentication on the Bull Board dashboard served on the worker HTTP port, letting unauthenticated attackers access and modify queue data and jobs, exploit requires no authentication.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2026/CVE-2026-116817.yaml"}
{"ID":"CVE-2026-11801","Info":{"Name":"WPAdverts \u003c= 2.3.2 - Information Disclosure","Severity":"high","Description":"WPAdverts – Classifieds Plugin for WordPress \u003c= 2.3.2 contains an authorization bypass caused by improper user authorization verification in classifieds-types REST endpoint, letting unauthenticated attackers retrieve internal site configuration data, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-11801.yaml"}
{"ID":"CVE-2026-118523","Info":{"Name":"EventPrime \u003c 4.3.6.1 - Unauthenticated Pending Post Disclosure","Severity":"medium","Description":"EventPrime WordPress plugin \u003c 4.3.6.1 contains a broken access control vulnerability caused by improper handling of Pending Review post status, letting unauthenticated users view non-public content awaiting review, exploit requires no authentication.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-118523.yaml"}
{"ID":"CVE-2026-118539","Info":{"Name":"Drupal Commerce Core \u003c 3.3.13 / \u003c 8.x-2.41 - Guest Cart Admin Access Bypass","Severity":"critical","Description":"Drupal Commerce Core before 3.3.13 on the 3.x branch and before 8.x-2.41\non the 2.x branch does not sufficiently protect certain order administration\nroutes. This template finds a public product using a bounded set of 63\ncanonical product IDs, adds one item to a fresh guest cart, and checks\nwhether the guest can read that cart order's administrative state-transition\nform. No account, prior order ID, JSON:API, or checkout is required. The\nguest draft order persists. Sites without a usable product among the sampled\nIDs produce no finding, which is inconclusive.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-118539.yaml"}
{"ID":"CVE-2026-119495","Info":{"Name":"WordPress Better Search \u003c 4.5.3 - Unauthenticated Arbitrary Post Type Content Disclosure","Severity":"medium","Description":"WebberZone Better Search \u003c= 4.5.2 contains a broken access control caused by incorrectly configured access control security levels, letting attackers exploit unauthorized access, exploit requires no special privileges.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-119495.yaml"}
{"ID":"CVE-2026-120201","Info":{"Name":"Jpom 2.10.0-2.11.12 - Authentication Bypass","Severity":"critical","Description":"Jpom 2.10.0 through 2.11.12 contains an authentication bypass caused by injection of query conditions into the JPOM-USER-TOKEN header, letting unauthenticated attackers gain super-administrator access and execute commands, exploit requires crafted header injection.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-120201.yaml"}
{"ID":"CVE-2026-120442","Info":{"Name":"ape-volo-admin \u003c= 3.5.2 - Authentication Bypass via Hardcoded JWT Signing Key","Severity":"critical","Description":"ape-volo-admin \u003c 3.6.1 contains an authentication bypass caused by a hardcoded JWT signing key in appsettings.json, letting unauthenticated attackers forge administrator tokens and gain full API control, exploit requires knowledge of the hardcoded key.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-120442.yaml"}
{"ID":"CVE-2026-120446","Info":{"Name":"madong-admin-saas \u003c= 5.1.4 - Unauthenticated Platform Tenant Management Access","Severity":"high","Description":"madong-admin-saas \u003c= 5.1.4 contains a broken authentication caused by 'platformapi' middleware key mismatch in platform tenant management API, letting unauthenticated remote attackers manage tenants and subscription plans.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-120446.yaml"}
{"ID":"CVE-2026-120597","Info":{"Name":"WordPress Welcart e-Commerce \u003c 2.12.7 - Cross-Site Scripting","Severity":"medium","Description":"Welcart e-Commerce Plugin up to 2.12.6 contains a stored XSS caused by improper escaping of the ResponseCd argument in ESCOTT_MAIN::error_page_message, letting remote attackers execute scripts, exploit requires crafted input.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2026/CVE-2026-120597.yaml"}
{"ID":"CVE-2026-1207","Info":{"Name":"Django RasterField - SQL Injection","Severity":"high","Description":"Django \u003c 6.0.2, \u003c 5.2.11, and \u003c 4.2.28 contains a SQL injection caused by improper sanitization of the band index parameter in RasterField on PostGIS, letting remote attackers inject SQL, exploit requires crafted input.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2026/CVE-2026-1207.yaml"}
{"ID":"CVE-2026-12227","Info":{"Name":"Visual Composer \u003c= 45.16.0 - Unauthenticated LFI","Severity":"critical","Description":"Visual Composer Website Builder for WordPress \u003c= 45.16.0 contains a local file inclusion vulnerability caused by improper validation of the vcv-template parameter, letting unauthenticated attackers include and execute arbitrary files, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-12227.yaml"}
{"ID":"CVE-2026-12394","Info":{"Name":"WordPress MemberGlut \u003c 1.1.5 - Unauthenticated Privilege Escalation","Severity":"critical","Description":"MemberGlut WordPress plugin \u003c 1.1.5 contains a broken access control vulnerability caused by lack of validation of roles during front-end registration, letting unauthenticated users register with arbitrary roles including administrator, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-12394.yaml"}
{"ID":"CVE-2026-12583","Info":{"Name":"Newsletters \u003c 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field","Severity":"high","Description":"The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, write arbitrary files and execute code on the server.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2026/CVE-2026-12583.yaml"}
{"ID":"CVE-2026-12609","Info":{"Name":"Eclipse Theia - Unauthenticated Path Traversal","Severity":"high","Description":"Eclipse Theia's plugin-ext backend exposes the hostedPlugin endpoint without constraining the resolved path to the plugin directory. An unauthenticated request using encoded traversal sequences can therefore read files accessible to the backend process. The built-in vscode_bat plugin identifier provides a deterministic anchor without target-specific setup.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-12609.yaml"}
{"ID":"CVE-2026-12741","Info":{"Name":"WP Fast Total Search \u003c= 1.80.280 - Unauthenticated Time-Based Blind SQL Injection","Severity":"high","Description":"WP Fast Total Search (fulltext-search) versions up to and including 1.80.280 contain an unauthenticated time-based blind SQL injection. The wp_ajax_nopriv_wpfts_autocomplete handler reads the form_data[s] parameter and feeds it into a WP_Query. The plugin's index_sql_where() builds its cluster query with double-quoted string literals using esc_like() which only escapes LIKE wildcards and not quotes, allowing a double quote to break out of the literal. When form_data[sentence] is set, the search term is used verbatim, giving a clean injection point.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-12741.yaml"}
{"ID":"CVE-2026-1277","Info":{"Name":"URL Shortify \u003c= 1.12.1 - Open Redirect","Severity":"medium","Description":"The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirect_to' parameter in the promotional dismissal handler. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites via a crafted link.\n","Classification":{"CVSSScore":"4.7"}},"file_path":"http/cves/2026/CVE-2026-1277.yaml"}
@@ -3978,6 +4015,7 @@
{"ID":"CVE-2026-1281","Info":{"Name":"Ivanti EPMM \u003c=12.7.0.0 - Unauthenticated Code Injection","Severity":"critical","Description":"Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.0 through 12.7.0.0 contain a code injection vulnerability that allows unauthenticated remote attackers to achieve arbitrary code execution on the target system.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-1281.yaml"}
{"ID":"CVE-2026-12898","Info":{"Name":"All-in-One WP Migration and Backup \u003c 7.106 - Arbitrary Log File Write","Severity":"medium","Description":"The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path. This makes it possible for unauthenticated attackers to create or append a log file in arbitrary locations outside the intended storage directory.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2026/CVE-2026-12898.yaml"}
{"ID":"CVE-2026-1296","Info":{"Name":"Frontend Post Submission Manager Lite \u003c= 1.2.7 - Open Redirect","Severity":"medium","Description":"The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficient validation on the 'requested_page' POST parameter in the verify_username_password function. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action such as clicking on a link.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-1296.yaml"}
{"ID":"CVE-2026-12970","Info":{"Name":"WordPress LearnPress \u003c 4.4.1 - Cross-Site Scripting","Severity":"high","Description":"LearnPress \u003c 4.4.1 does not escape the c_search parameter before reflecting it into the value attribute of the search input on the Course Builder questions page (/course-builder/questions/), allowing attribute-injection reflected XSS against authenticated admins/instructors.\n","Classification":{"CVSSScore":"7.1"}},"file_path":"http/cves/2026/CVE-2026-12970.yaml"}
{"ID":"CVE-2026-13001","Info":{"Name":"Podlove Podcast Publisher \u003c= 4.5.1 - Arbitrary File Upload","Severity":"critical","Description":"Podlove Podcast Publisher plugin for WordPress through 4.5.1 is vulnerable to arbitrary file uploads due to missing file type validation in the podlove_handle_cache_files function. The image cache derives the stored file extension from the path of the attacker supplied source URL, while the image validation is performed against a different file name taken from the full source URL, so a source URL whose path carries a dangerous extension is written to the cache with that extension.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-13001.yaml"}
{"ID":"CVE-2026-1306","Info":{"Name":"WordPress midi-Synth \u003c= 1.1.0 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"WordPress midi-Synth plugin \\u003C= 1.1.0 contains an unrestricted file upload vulnerability caused by missing file type and extension validation in the 'export' AJAX action, letting unauthenticated attackers upload arbitrary files and potentially execute remote code, exploit requires attacker to obtain a valid nonce exposed in frontend JavaScript.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-1306.yaml"}
{"ID":"CVE-2026-1314","Info":{"Name":"WordPress 3D FlipBook \u003c= 1.16.17 - Information Disclosure","Severity":"medium","Description":"WordPress 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery plugin versions \u003c= 1.16.17 contain a missing authorization vulnerability in multiple AJAX endpoints. The fb3d_send_posts_in, fb3d_send_post_pages, fb3d_send_posts_in_pages, fb3d_send_posts_in_first_page, and fb3d_send_post_first_page handlers are registered with wp_ajax_nopriv hooks but fail to verify the post status of requested flipbook entries. This allows unauthenticated attackers to retrieve full metadata, PDF URLs, and configuration data of private, draft, and password-protected flipbook posts.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-1314.yaml"}
@@ -3989,6 +4027,7 @@
{"ID":"CVE-2026-13731","Info":{"Name":"WPBot \u003c= 8.4.9 - Cross-Site Scripting","Severity":"high","Description":"WPBot \u003c= 8.4.9 is vulnerable to stored cross-site scripting via the conversation parameter in the qcld_wb_chatbot_conversation_save AJAX action. The AJAX nonce (qcsecretbotnonceval123qc) is publicly emitted on every frontend page via wp_localize_script under the ajax_nonce key, making it freely obtainable by unauthenticated visitors. The conversation parameter is saved to the database without sanitization and rendered unsanitized in the admin chat session view, causing stored XSS that executes when an administrator views saved chat sessions.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2026/CVE-2026-13731.yaml"}
{"ID":"CVE-2026-1405","Info":{"Name":"WordPress Slider Future \u003c= 1.0.5 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"Slider Future WordPress plugin \u003c= 1.0.5 contains an unrestricted file upload vulnerability caused by missing file type validation in 'slider_future_handle_image_upload', letting unauthenticated attackers upload arbitrary files, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-1405.yaml"}
{"ID":"CVE-2026-14483","Info":{"Name":"Realtyna Organic IDX/WPL \u003c= 5.2.0 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress \u003c= 5.2.0 contains an unrestricted file upload vulnerability caused by missing file type validation and static API credentials, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit requires knowledge of static API credentials.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-14483.yaml"}
{"ID":"CVE-2026-14554","Info":{"Name":"WordPress Check \u0026 Log Email \u003c 2.0.15 - SQL Injection","Severity":"medium","Description":"The Check \u0026 Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2026/CVE-2026-14554.yaml"}
{"ID":"CVE-2026-14870","Info":{"Name":"WordPress Database for Contact Form 7, WPforms, Elementor forms \u003c 1.5.3 - Cross-Site Scripting","Severity":"high","Description":"Database for Contact Form 7, WPforms, Elementor forms WordPress plugin \u003c 1.5.3 contains a reflected XSS caused by improper sanitization and escaping of a parameter in an admin page, letting attackers execute scripts against admin users, exploit requires admin access.\n","Classification":{"CVSSScore":"7.1"}},"file_path":"http/cves/2026/CVE-2026-14870.yaml"}
{"ID":"CVE-2026-14894","Info":{"Name":"WordPress Super Forms \u003c= 6.3.313 - Arbitrary File Upload","Severity":"critical","Description":"Super Forms – Drag \u0026 Drop Form Builder WordPress plugin \\u003C= 6.3.313 contains an arbitrary file upload vulnerability caused by missing file type validation and lack of capability checks in submit_form nopriv AJAX handler, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit requires no authentication due to nonce bypass.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-14894.yaml"}
{"ID":"CVE-2026-1492","Info":{"Name":"WordPress User Registration \u0026 Membership \u003c= 5.1.2 - Unauthenticated Privilege Escalation","Severity":"critical","Description":"User Registration \u0026 Membership WordPress plugin \u003c= 5.1.2 contains an improper privilege management vulnerability caused by accepting user-supplied roles without server-side allowlist enforcement, letting unauthenticated attackers create administrator accounts\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-1492.yaml"}
@@ -4001,9 +4040,12 @@
{"ID":"CVE-2026-1603","Info":{"Name":"Ivanti Endpoint Manager - Authentication Bypass","Severity":"high","Description":"Ivanti Endpoint Manager \u003c 2024 SU5 contains an authentication bypass caused by improper access control, letting remote unauthenticated attackers leak stored credential data, exploit requires no special privileges.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2026/CVE-2026-1603.yaml"}
{"ID":"CVE-2026-16268","Info":{"Name":"Newsletters \u003c 4.16 - Unauthenticated SSRF via SNS Bounce Handler","Severity":"medium","Description":"Newsletters WordPress plugin \u003c 4.16 contains a server-side request forgery caused by lack of authentication and validation in bounce-processing requests, letting unauthenticated attackers make arbitrary requests to internal or external hosts.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-16268.yaml"}
{"ID":"CVE-2026-16535","Info":{"Name":"WordPress Link Library \u003c 7.9.4 - Cross-Site Scripting","Severity":"medium","Description":"Link Library WordPress plugin \u003c 7.9.4 contains a reflected XSS caused by unsanitised and unescaped parameter reflected in response, letting unauthenticated attackers execute scripts via user interaction.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-16535.yaml"}
{"ID":"CVE-2026-16959","Info":{"Name":"WordPress Media Library Assistant \u003c 3.40 - SQL Injection","Severity":"medium","Description":"The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role and above to perform SQL injection.\n","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2026/CVE-2026-16959.yaml"}
{"ID":"CVE-2026-17505","Info":{"Name":"WordPress TranslatePress \u003c 3.2.6 - Cross-Site Scripting","Severity":"medium","Description":"TranslatePress plugin \u003c 3.2.6 for WordPress contains a reflected cross-site scripting vulnerability in the translation marker processing feature, letting attackers inject and execute arbitrary JavaScript code, exploit requires no authentication or privileges.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-17505.yaml"}
{"ID":"CVE-2026-17532","Info":{"Name":"Seraphinite Accelerator \u003c= 2.29.18 - Cross-Site Scripting","Severity":"medium","Description":"The Seraphinite Accelerator plugin for WordPress up to and including 2.29.18 was vulnerable to reflected cross-site scripting through the seraph_accel_prep parameter. CacheExtractPreparePageParams() compared the expected HMAC against the JSON-decoded nonce with PHP's loose != operator, so a JSON boolean true satisfied the comparison and bypassed the signature check, and _CbContentFinishSkip() then concatenated the attacker-controlled selfTest field straight into the response body, letting unauthenticated attackers inject arbitrary scripts.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-17532.yaml"}
{"ID":"CVE-2026-17540","Info":{"Name":"WordPress Bit File Manager \u003c 6.9.1 - Arbitrary File Read","Severity":"high","Description":"The Bit File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-17540.yaml"}
{"ID":"CVE-2026-17594","Info":{"Name":"Sonatype Nexus Repository \u003c 3.95.0 - Privilege Escalation via Repository Format Mismatch","Severity":"high","Description":"Nexus Repository 3 CE/Pro 3.0.0 through 3.94.x contains an incorrect authorization vulnerability caused by inconsistent authorization checks in the repository-creation UI, letting delegated repository-admin users create unauthorized repository formats, exploit requires delegated repository-admin privilege.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2026/CVE-2026-17594.yaml"}
{"ID":"CVE-2026-18051","Info":{"Name":"W3 Total Cache \u003c 2.10.5 - Unauthenticated Arbitrary Directory File Write","Severity":"critical","Description":"W3 Total Cache WordPress plugin \u003c 2.10.5 contains an unrestricted file write vulnerability caused by improper validation of request paths used for cache file names, letting unauthenticated attackers overwrite files including .htaccess, exploit requires no authentication.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-18051.yaml"}
{"ID":"CVE-2026-18072","Info":{"Name":"Advanced Responsive Video Embedder 10.8.7/10.8.8 - Hardcoded Backdoor Authentication Bypass","Severity":"critical","Description":"The compromised Advanced Responsive Video Embedder WordPress plugin releases 10.8.7 and 10.8.8 accept a hardcoded token through the `_wplogin` parameter and establish an authenticated administrator session before normal authentication. A single unauthenticated GET request triggers the backdoor. This template only inspects the redirect and session-cookie response and does not perform any administrative action.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-18072.yaml"}
{"ID":"CVE-2026-18110","Info":{"Name":"Concrete CMS - User Enumeration","Severity":"high","Description":"Concrete CMS versions 9.0.0 through 9.5.2 are vulnerable to unauthenticated user enumeration via a missing authorization check in the \"Preview As User\" panel (concrete/controllers/panel/page/preview_as_user.php).\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-18110.yaml"}
{"ID":"CVE-2026-18143","Info":{"Name":"Request Quote for WooCommerce \u003c= 2.9.2 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"Request a Quote for WooCommerce plugin for WordPress \u003c= 2.9.2 contains an unrestricted file upload vulnerability caused by missing file extension and MIME type validation in afrfq_submit_quote_via_popup(), letting unauthenticated attackers upload executable files, exploit requires enabled public quote rule with multi-page popup flow.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-18143.yaml"}
@@ -4039,6 +4081,7 @@
{"ID":"CVE-2026-2262","Info":{"Name":"Easy Appointments \u003c= 3.12.21 - Information Disclosure","Severity":"high","Description":"Easy Appointments WordPress plugin \u003c= 3.12.21 contains a sensitive information exposure caused by an unauthenticated REST API endpoint /wp-json/wp/v2/eablocks/ea_appointments/ registered with permission_callback allowing unrestricted access, letting unauthenticated attackers extract sensitive customer appointment data.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-2262.yaml"}
{"ID":"CVE-2026-22683","Info":{"Name":"Windmill \u003c 1.603.3 - Operator Authorization Bypass","Severity":"high","Description":"Windmill versions 1.276.0 through 1.603.2 contain an authorization bypass vulnerability in the folder management API endpoints. The endpoints for creating, deleting, and managing folder ownership do not enforce role-based access control for operator-level users. In Windmill, operators are restricted users intended to only execute existing scripts, but due to missing server-side authorization checks, operators can create folders, manage folder permissions, and access owner management endpoints. This bypass serves as the prerequisite for exploiting CVE-2026-23696 (SQL injection via folder addowner) enabling full privilege escalation from operator to super admin with remote code execution.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2026/CVE-2026-22683.yaml"}
{"ID":"CVE-2026-22739","Info":{"Name":"Spring Cloud Config Server - Path Traversal","Severity":"high","Description":"Spring Cloud 3.1.x \u003c 3.1.13, 4.1.x \u003c 4.1.9, 4.2.x \u003c 4.2.3, 4.3.x \u003c 4.3.2, and 5.0.x \u003c 5.0.2 contain a path traversal caused by profile parameter substitution in Config Server using native file system backend, letting attackers access files outside configured directories, exploit requires crafted request.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2026/CVE-2026-22739.yaml"}
{"ID":"CVE-2026-22777","Info":{"Name":"ComfyUI-Manager \u003c 3.39.2 - CRLF Configuration Injection","Severity":"high","Description":"ComfyUI-Manager is an extension designed to enhance the usability of ComfyUI. Prior to versions 3.39.2 and 4.0.5, an attacker can inject special characters into HTTP query parameters to add arbitrary configuration values to the config.ini file. This can lead to security setting tampering or modification of application behavior.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-22777.yaml"}
{"ID":"CVE-2026-22778","Info":{"Name":"vLLM 0.8.3 - 0.14.0 - Information Disclosure","Severity":"critical","Description":"vLLM 0.8.3 to - 0.14.1 contains an information disclosure caused by leaking a heap address in error messages from the multimodal endpoint when processing invalid images, letting remote attackers reduce ASLR entropy, exploit requires sending invalid images.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-22778.yaml"}
{"ID":"CVE-2026-22812","Info":{"Name":"OpenCode \u003c 1.0.216 - Unauthenticated Remote Code Execution","Severity":"high","Description":"OpenCode versions prior to 1.0.216 contain an unauthenticated remote code execution vulnerability. The application exposes session and shell execution endpoints without proper authentication, allowing remote attackers to create sessions and execute arbitrary shell commands on the underlying server.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-22812.yaml"}
{"ID":"CVE-2026-23482","Info":{"Name":"Blinko \u003c 1.8.4 - Path Traversal","Severity":"high","Description":"Blinko \u003c 1.8.4 contains a path traversal vulnerability caused by lack of permission checks and filtering on the temp/ path in the file server endpoint, letting unauthorized attackers read arbitrary files including backup files with user notes and tokens, exploit requires no special privileges.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-23482.yaml"}
@@ -4057,6 +4100,7 @@
{"ID":"CVE-2026-24207","Info":{"Name":"NVIDIA Triton Inference Server \u003c= 26.02 - Authentication Bypass","Severity":"critical","Description":"NVIDIA Triton Inference Server contains an authentication bypass vulnerability, letting attackers bypass authentication and potentially execute code, escalate privileges, tamper data, cause denial of service, or disclose information, exploit requires no special conditions.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-24207.yaml"}
{"ID":"CVE-2026-24423","Info":{"Name":"SmarterMail - Remote Code Execution","Severity":"critical","Description":"SmarterTools SmarterMail \u003c build 9511 contains an unauthenticated remote code execution caused by malicious OS command execution via ConnectToHub API method, letting remote attackers execute arbitrary commands, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-24423.yaml"}
{"ID":"CVE-2026-24477","Info":{"Name":"AnythingLLM - Information Disclosure","Severity":"high","Description":"AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. If AnythingLLM prior to version 1.10.0 is configured to use Qdrant as the vector database with an API key, this QdrantApiKey could be exposed in plain text to unauthenticated users via the `/api/setup-complete` endpoint. Leakage of QdrantApiKey allows an unauthenticated attacker full read/write access to the Qdrant vector database instance used by AnythingLLM. Since Qdrant often stores the core knowledge base for RAG in AnythingLLM, this can lead to complete compromise of the semantic search / retrieval functionality and indirect leakage of confidential uploaded documents. Version 1.10.0 patches the issue.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-24477.yaml"}
{"ID":"CVE-2026-24898","Info":{"Name":"OpenEMR \u003c 8.0.0 - MedEx Callback Unauthenticated Token Disclosure","Severity":"critical","Description":"OpenEMR \u003c 8.0.0 contains an unauthenticated token disclosure caused by bypassing authentication in the MedEx callback endpoint, letting unauthenticated visitors obtain MedEx API tokens and perform unauthorized actions, exploit requires crafted POST request with callback_key.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2026/CVE-2026-24898.yaml"}
{"ID":"CVE-2026-25231","Info":{"Name":"FileRise \u003c= 3.3.0 - Unauthenticated File Read","Severity":"high","Description":"FileRise \u003c= 3.3.0 contains an unauthenticated file read vulnerability caused by a lack of access control on the /uploads directory, letting unauthenticated attackers access uploaded files directly, exploit requires knowledge or guessing of file paths.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-25231.yaml"}
{"ID":"CVE-2026-25512","Info":{"Name":"Group-Office \u003c 26.0.5 - Remote Code Execution","Severity":"critical","Description":"Group-Office before versions 6.8.150, 25.0.82, and 26.0.5 is vulnerable to remote code execution via OS command injection. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmp_file into an exec() call. By injecting shell metacharacters into tmp_file, an authenticated attacker can execute arbitrary system commands on the server.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2026/CVE-2026-25512.yaml"}
{"ID":"CVE-2026-25527","Info":{"Name":"changedetection.io \u003c= 0.52.9 - Unauthenticated Path Traversal","Severity":"medium","Description":"changedetection.io \u003c= 0.53.9 contains a path traversal caused by improper validation of the 'group' parameter in /static/\u003cgroup\u003e/\u003cfilename\u003e route, letting unauthenticated attackers read local application source files.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-25527.yaml"}
@@ -4143,6 +4187,7 @@
{"ID":"CVE-2026-3395","Info":{"Name":"MaxSite CMS \u003c=109.1 - Remote Code Execution","Severity":"high","Description":"MaxSite CMS through 109.1 allows unauthenticated remote attackers to execute arbitrary code via the MarkItUp editor preview AJAX endpoint, preview-ajax.php. The endpoint insufficiently authenticates the request, failing to ensure the user is logged in, and processes the attacker's input via unsafe usage of PHP eval() on user-supplied [php]...[/php] shortcodes. By providing a POST request to the vulnerable /ajax/ endpoint with crafted input, attackers may achieve remote code execution. The issue is addressed in version 109.2 by implementing proper authentication controls.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2026/CVE-2026-3395.yaml"}
{"ID":"CVE-2026-3396","Info":{"Name":"WCAPF WooCommerce Ajax Product Filter - SQL Injection","Severity":"high","Description":"WCAPF WooCommerce Ajax Product Filter \u003c= 4.2.3 contains a time-based SQL injection caused by insufficient escaping of the 'post-author' parameter, letting unauthenticated attackers extract sensitive database information remotely.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-3396.yaml"}
{"ID":"CVE-2026-34036","Info":{"Name":"Dolibarr \u003c=22.0.4 - Local File Inclusion","Severity":"medium","Description":"Dolibarr \u003c= 22.0.4 contains a local file inclusion caused by manipulation of the objectdesc parameter and a fail-open logic flaw in restrictedArea() in /core/ajax/selectobject.php, letting authenticated users with no specific privileges read arbitrary non-PHP files.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2026/CVE-2026-34036.yaml"}
{"ID":"CVE-2026-34151","Info":{"Name":"XWiki Platform - Path Traversal","Severity":"high","Description":"XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected lookup is replaced with Environment.getResourceAsStream(String, String), which constrains a resource to its expected prefix. An unauthenticated remote attacker can use the vulnerable behavior to read arbitrary resources permitted to the Jetty process, including WEB-INF/xwiki.cfg and, depending on deployment depth and operating-system permissions, host files. Tomcat and Jetty versions before 12 do not appear affected. This issue is fixed in versions 17.10.5 and 18.2.0.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2026/CVE-2026-34151.yaml"}
{"ID":"CVE-2026-34156","Info":{"Name":"NocoBase - VM Sandbox Escape to Remote Code Execution","Severity":"critical","Description":"NocoBase Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist controlled by WORKFLOW_SCRIPT_MODULES env var. The console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console._stdout and console._stderr. An authenticated attacker can traverse the prototype chain (console._stdout.constructor.constructor to Function to process to child_process) to escape the sandbox and achieve Remote Code Execution as root.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-34156.yaml"}
{"ID":"CVE-2026-34197","Info":{"Name":"Apache ActiveMQ - Remote Code Execution","Severity":"critical","Description":"Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: . Users are recommended to upgrade to version 5.19.5 or 6.2.3, which fixes the issue.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-34197.yaml"}
{"ID":"CVE-2026-34234","Info":{"Name":"CtrlPanel \u003c= 1.1.1 - Remote Code Execution","Severity":"critical","Description":"CtrlPanel versions \u003c= 1.1.1 are vulnerable to unauthenticated Remote Code Execution (RCE) via the web installer endpoint (public/installer/index.php). The installer loaded and executed form handler files before checking for the install.lock gate, allowing attackers to reach installer forms on fully-deployed instances. User-supplied POST values (url, key, clientkey) from the Pterodactyl configuration form were interpolated directly into shell command strings executed via bash -c without sanitization, enabling command injection. The vulnerability is confirmed actively exploited in the wild.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-34234.yaml"}
@@ -4233,6 +4278,7 @@
{"ID":"CVE-2026-47670","Info":{"Name":"DbGate - Remote Code Execution via Dynamic Import Bypass","Severity":"critical","Description":"DbGate versions \u003c= 7.1.8 are vulnerable to authenticated remote code execution via the POST /runners/load-reader endpoint. The functionName parameter is directly interpolated into a JavaScript code template without sanitization. The require=null mitigation is bypassed via dynamic import().\n","Classification":{"CVSSScore":"9.4"}},"file_path":"http/cves/2026/CVE-2026-47670.yaml"}
{"ID":"CVE-2026-47717","Info":{"Name":"FUXA 1.3.0 - Unauthenticated ICS/SCADA Project Data Disclosure","Severity":"high","Description":"FUXA v1.3.0 exposes full SCADA/HMI project configuration via GET /api/project without authentication, even when secureEnabled is true. The secureFnc middleware auto-generates\na valid guest JWT when no token is provided, bypassing authentication. Exposed data includes server-side scripts, device configs, HMI views, and alarm definitions.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-47717.yaml"}
{"ID":"CVE-2026-48030","Info":{"Name":"Pheditor 2.0.1-2.0.3 - OS Command Injection","Severity":"critical","Description":"Pheditor 2.0.1 to - 2.0.4 contains an OS command injection caused by improper sanitization of the 'dir' POST parameter in the terminal action handler, letting authenticated users execute arbitrary OS commands with web server privileges.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2026/CVE-2026-48030.yaml"}
{"ID":"CVE-2026-48048","Info":{"Name":"XWiki Platform - Password Hash Disclosure","Severity":"high","Description":"XWiki Platform is a generic wiki platform. The patch for GHSA-5cf8-vrr8-8hjm / CVE-2023-26476 was insufficient. Starting with version 6.2.1 and prior to 16.10.17, 17.4.9, 17.10.13, and 18.0.0RC1, slightly modified LiveTableResults parameters (for example password_class) still allow an unauthenticated attacker to discover password hashes one bit at a time. With about 768 requests, the full password salt and hash of a user can be retrieved. The check for password and email properties does not consider the class passed via the _class parameters.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-48048.yaml"}
{"ID":"CVE-2026-4810","Info":{"Name":"Google ADK-Python - Unauthenticated Builder Endpoint","Severity":"critical","Description":"Google Agent Development Kit (ADK) 1.7.0 through 1.28.1 and 2.0.0a1 through 2.0.0a2 on Python (OSS), Cloud Run, and GKE contains a code injection and missing authentication vulnerability, letting unauthenticated remote attackers execute arbitrary code on the server, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-4810.yaml"}
{"ID":"CVE-2026-48282","Info":{"Name":"Adobe ColdFusion - RDS Arbitrary File Write","Severity":"critical","Description":"ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. The RDS FILEIO WRITE operation allows unauthenticated attackers to write arbitrary files when RDS is enabled with authentication disabled. Exploitation of this issue does not require user interaction. Scope is changed.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-48282.yaml"}
{"ID":"CVE-2026-48313","Info":{"Name":"ColdFusion - Path Traversal","Severity":"high","Description":"ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read and limited write access. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-48313.yaml"}
@@ -4263,6 +4309,7 @@
{"ID":"CVE-2026-52806","Info":{"Name":"Gogs \u003c= 0.14.2 - Authenticated RCE via git rebase Argument Injection","Severity":"critical","Description":"Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the \"Rebase before merging\" merge operation.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2026/CVE-2026-52806.yaml"}
{"ID":"CVE-2026-52815","Info":{"Name":"Gogs \u003c 0.14.3 - Unauthenticated Organization Teams Disclosure","Severity":"low","Description":"Gogs before version 0.14.3 contains an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint returns all teams for any organization without requiring authentication. The route group lacks the reqToken() middleware, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2026/CVE-2026-52815.yaml"}
{"ID":"CVE-2026-52824","Info":{"Name":"Kimai \u003c= 2.57.0 - Default APP_SECRET Authentication Bypass","Severity":"critical","Description":"Kimai Docker images \u003c= 2.57.0 ship with a hardcoded APP_SECRET of \"change_this_to_something_unique\". This default secret is used by Symfony's SignatureHasher to HMAC-sign login links and remember-me cookies. An unauthenticated attacker who knows this default secret can forge valid authentication tokens and hijack any user account, including the super-admin.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-52824.yaml"}
{"ID":"CVE-2026-53468","Info":{"Name":"Typemill CMS \u003c 2.23.0 - Cross-Site Scripting","Severity":"medium","Description":"Typemill CMS before version 2.23.0 is vulnerable to stored HTML attribute injection in the page metadata fields (og:title and og:description). An authenticated user with permission to modify page metadata can inject arbitrary HTML attributes into generated meta tags via the /api/v1/meta endpoint due to missing output encoding in the renderMeta() function in system/typemill/Assets.php.\n","Classification":{"CVSSScore":"4.6"}},"file_path":"http/cves/2026/CVE-2026-53468.yaml"}
{"ID":"CVE-2026-53519","Info":{"Name":"Nezha Dashboard \u003c 2.0.13 - Path Traversal","Severity":"critical","Description":"Nezha Monitoring \u003c 2.0.13 contains a path traversal caused by improper prefix checking in the dashboard's NoRoute handler, letting unauthenticated attackers read arbitrary files via crafted URLs.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-53519.yaml"}
{"ID":"CVE-2026-53576","Info":{"Name":"Kestra \u003c= 1.3.20 - Remote Code Execution","Severity":"critical","Description":"Kestra \u003c= 1.3.20 contains an authentication bypass caused by misclassification of /configs endpoint in REST API filter, letting unauthenticated attackers create and execute root-level tasks, exploit requires unauthenticated access to /configs endpoint.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-53576.yaml"}
{"ID":"CVE-2026-53595","Info":{"Name":"FreeScout \u003c 1.8.224 - Invite Hash Authorization Bypass","Severity":"critical","Description":"FreeScout prior to 1.8.224 contains an authentication bypass caused by improper invite_hash handling and decryption failure in user setup endpoint, letting anonymous attackers reset credentials and log in as the lowest-id activated user, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.4"}},"file_path":"http/cves/2026/CVE-2026-53595.yaml"}
@@ -4275,6 +4322,7 @@
{"ID":"CVE-2026-54069","Info":{"Name":"SiYuan Note \u003c= 3.6.5 - Authentication Bypass","Severity":"high","Description":"SiYuan Note 3.6.5 and prior is vulnerable to authentication bypass. The CheckAuth middleware unconditionally trusted all chrome-extension:// origins, granting RoleAdministrator access without token validation to any request with a spoofed Origin header. Fixed in v3.7.0.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-54069.yaml"}
{"ID":"CVE-2026-54157","Info":{"Name":"LobeHub LobeChat \u003c= 2.1.56 - Server-Side Request Forgery","Severity":"medium","Description":"LobeHub LobeChat versions up to and including 2.1.56 are vulnerable to an unauthenticated server-side request forgery vulnerability in the /webapi/proxy endpoint. The endpoint accepts a URL in the POST request body and fetches it server-side without authentication.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-54157.yaml"}
{"ID":"CVE-2026-54236","Info":{"Name":"vLLM \u003c= 0.23.0 - Anthropic Router Heap Address Information Leak","Severity":"medium","Description":"vLLM \u003c= 0.23.0 incompletely fixes CVE-2026-22778. The original fix added sanitize_message to the OpenAI router but the Anthropic-compatible router (/v1/messages) echoes str(exc) directly.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-54236.yaml"}
{"ID":"CVE-2026-54419","Info":{"Name":"PIAF-HMS ec.php - SQL Injection","Severity":"critical","Description":"claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commit 389d2633441b65ced1c104212cd62be2bfca21e5) contains multiple unauthenticated SQL injection vulnerabilities. The application has no authentication mechanism and passes user-supplied HTTP parameters directly into deprecated mysql_query calls via string concatenation, without sanitization, escaping, or parameterization.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-54419.yaml"}
{"ID":"CVE-2026-54617","Info":{"Name":"GravitLauncher LaunchServer \u003c=5.7.11 - Unauthenticated Path Traversal to Arbitrary File Read","Severity":"critical","Description":"LaunchServer's Netty FileServerHandler computes the served path by stripping one leading character on the assumption that every request-target begins with '/'. Netty's HttpServerCodec accepts a request-target without a leading slash verbatim, so a request without a leading slash bypasses path normalization and escapes the updatesDir. The file server is enabled by default (netty.fileServerEnabled=true) on 0.0.0.0:9274 with no authentication, allowing an unauthenticated remote GET to read any file readable by the LaunchServer process including its own ECDSA signing key (.keys/ecdsa_id), which signs access JWTs and enables full authentication bypass for any account.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-54617.yaml"}
{"ID":"CVE-2026-54836","Info":{"Name":"YMC Filter - SQL Injection","Severity":"critical","Description":"YMC Filter \u003c= 3.11.5 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-54836.yaml"}
{"ID":"CVE-2026-54917","Info":{"Name":"SeaweedFS \u003c= 4.29 - Path Traversal File Write","Severity":"high","Description":"SeaweedFS versions through 4.29 build the S3 API and Iceberg REST catalog routers with mux.NewRouter().SkipClean(true), which disables URL path cleaning. A `..` segment in the request path therefore survives routing and reaches the handlers unnormalised, so a request such as `PUT /bucket-A/../evil-bucket/key` is matched as bucket=bucket-A with object=../evil-bucket/key. The captured object key is then joined into a filer path where the `..` is collapsed server-side, so the write lands in evil-bucket while authorisation is evaluated against bucket-A, enabling cross-bucket file write.\n","Classification":{"CVSSScore":"7.8"}},"file_path":"http/cves/2026/CVE-2026-54917.yaml"}
@@ -4287,6 +4335,7 @@
{"ID":"CVE-2026-55552","Info":{"Name":"Yamcs \u003c=5.11.12 - Arbitrary File Read","Severity":"high","Description":"Yamcs through 5.11.12 serves static web resources through a handler that resolves the requested path against the configured web root without rejecting absolute paths. A request path that begins with a double slash is resolved as an absolute filesystem path, discarding the web root, and the handler returns the referenced file from the underlying host, letting unauthenticated attackers read any non-hidden file readable by the Yamcs service account whose path contains no dot segment.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-55552.yaml"}
{"ID":"CVE-2026-55592","Info":{"Name":"Dashy \u003c= 4.3.6 - Reflected XSS via Workspace","Severity":"medium","Description":"Dashy versions up to 4.3.6 contain a reflected cross-site scripting vulnerability in the workspace view. The url query parameter is passed directly to an iframe src attribute without scheme validation, allowing an attacker to inject javascript: URIs that execute arbitrary JavaScript in the context of the Dashy origin.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-55592.yaml"}
{"ID":"CVE-2026-5562","Info":{"Name":"Provectus kafka-ui \u003c=0.7.2 - Remote Code Execution","Severity":"critical","Description":"Provectus kafka-ui versions 0.7.0 through 0.7.2 are vulnerable to code injection in the `/api/smartfilters/testexecutions` endpoint. The `filterCode` parameter is evaluated as a Groovy expression without sandboxing, allowing an unauthenticated attacker to execute arbitrary code and operating-system commands on the host.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-5562.yaml"}
{"ID":"CVE-2026-55864","Info":{"Name":"GeoNetwork - Server-Side Request Forgery (SSRF)","Severity":"high","Description":"GeoNetwork versions 4.0.0 to 4.2.16 and 4.4.0 to 4.4.11 are vulnerable to an unauthenticated server-side request forgery (SSRF) in the SLD tool. The POST /srv/api/tools/ogc/sld endpoint accepts a caller-supplied WMS server URL and performs a server-side HTTP GetStyles request to it without any validation, allowing an anonymous attacker to make the server issue arbitrary outbound HTTP requests to internal services and read XML responses back.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2026/CVE-2026-55864.yaml"}
{"ID":"CVE-2026-56062","Info":{"Name":"Quotes llama \u003c= 3.1.5 - SQL Injection","Severity":"critical","Description":"Quotes llama 3.1.5 and earlier contains a time-based blind SQL injection vulnerability caused by improper control of a SQL identifier. The select_search() AJAX handler (registered for guests via wp_ajax_nopriv_select_search) reads the attacker-controlled 'sc' parameter from $_POST and substitutes it into the query through the malformed wpdb placeholder '%1s'.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-56062.yaml"}
{"ID":"CVE-2026-56070","Info":{"Name":"Advance Product Search \u003c= 1.4.4 - Unauthenticated Time-Based Blind SQL Injection","Severity":"critical","Description":"Advance Product Search 1.4.4 and earlier is vulnerable to unauthenticated time-based blind SQL injection. The plugin rebuilds the WordPress search SQL by hand and uses $wpdb-\u003eesc_like() which escapes LIKE wildcards but not single quotes, allowing injection through the ?s= parameter.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-56070.yaml"}
{"ID":"CVE-2026-5615","Info":{"Name":"VvvebJs \u003c= 2.0.5 - Cross-Site Scripting","Severity":"medium","Description":"Givanz Vvvebjs \u003c= 2.0.5 contains a stored XSS caused by manipulation of the \"uploadAllowExtensions\" argument in upload.php File Upload Endpoint, letting remote attackers execute scripts, exploit requires crafted input.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2026/CVE-2026-5615.yaml"}
@@ -4309,6 +4358,7 @@
{"ID":"CVE-2026-58644","Info":{"Name":"Microsoft SharePoint Server - WS-Federation BinaryFormatter Deserialization RCE","Severity":"critical","Description":"Microsoft SharePoint Server (2016, 2019, Subscription Edition \u003c= 2026.3.1) contains a remote code execution vulnerability in the WS-Federation passive sign-in endpoint (/_trust/default.aspx). The SharePoint authentication module (SPFederationAuthenticationModuleV2) uses a deflate-only DeflateCookieTransform (no MAC/signature check) to decode and BinaryFormatter to deserialize the SecurityContextToken Cookie value in the wresult parameter without type restrictions. An unauthenticated attacker can send a crafted WS-Federation token containing a BinaryFormatter gadget chain (DataSet + LosFormatter + XamlAssemblyLoadFromFile) to execute arbitrary code in the context of the IIS application pool identity (w3wp.exe). The fix (KB5002882, July 2026 CU) replaces the DeflateCookieTransform with\nNotSupportedCookieTransform, making ReadToken() throw before deserialization.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-58644.yaml"}
{"ID":"CVE-2026-59177","Info":{"Name":"ESPHome Device Builder \u003c1.0.10 - Unauthenticated Dashboard Access","Severity":"high","Description":"ESPHome Device Builder versions before 1.0.10 bind the trusted Home Assistant ingress site to all interfaces. A client that can reach the ingress port can therefore access the dashboard without the Supervisor's authentication proxy.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-59177.yaml"}
{"ID":"CVE-2026-59509","Info":{"Name":"cve-search 4.0-6.0.0 - Unauthenticated NoSQL Injection","Severity":"critical","Description":"cve-search versions 4.0 through 6.0.0 expose an unauthenticated DataTables endpoint that accepts attacker-controlled MongoDB collection, projection, filtering, and pagination parameters. This detector uses a harmless invalid projection field against the intended cves collection; version 6.0.1 rejects that field.\n","Classification":{"CVSSScore":"9.2"}},"file_path":"http/cves/2026/CVE-2026-59509.yaml"}
{"ID":"CVE-2026-59707","Info":{"Name":"LocalAI \u003c 4.6.0 - Server-Side Request Forgery","Severity":"critical","Description":"LocalAI before 4.6.0 is affected by an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint. The gallery `url` field is passed to the gallery config fetcher without validation, allowing an unauthenticated attacker to make the server issue HTTP requests to arbitrary internal, loopback, link-local, and cloud-metadata addresses. The outcome of the server-side fetch is reflected in the model-apply job status.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-59707.yaml"}
{"ID":"CVE-2026-59726","Info":{"Name":"ruflo MCP Bridge - Unauthenticated RCE via terminal_execute","Severity":"critical","Description":"ruflo MCP bridge (\u003c 3.16.3) in its default docker-compose deployment exposes POST /mcp with no authentication and binds to all interfaces (0.0.0.0:3001). The executeTool() function has no server-side deny list for dangerous tools, allowing an unauthenticated attacker to invoke tools/call with ruflo__terminal_execute, which runs execSync(command) on attacker-supplied input. This yields arbitrary command execution as the node user (uid 1000) inside the bridge container. The blocklist (AUTOPILOT_BLOCKED_PATTERNS + isBlockedTool()) is enforced only in the autopilot SSE handler; POST /mcp and POST /mcp/:group bypass it entirely.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-59726.yaml"}
{"ID":"CVE-2026-59774","Info":{"Name":"Gitea 1.22.1-1.27.0 - Unauthenticated Arbitrary File Read","Severity":"critical","Description":"Gitea versions 1.22.1 through 1.27.0 initialize the go-org markup renderer without replacing its default ReadFile callback. An unauthenticated attacker can submit Org-mode markup containing an #+INCLUDE directive with an absolute path to the repository markup endpoint of any public repository, causing the server to read and render arbitrary files accessible to the Gitea service user.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-59774.yaml"}
{"ID":"CVE-2026-59801","Info":{"Name":"9Router - Unauthenticated LLM Provider API Exposure","Severity":"critical","Description":"9Router through version 0.4.41 contains an unauthenticated access vulnerability caused by missing authentication middleware in Next.js API routes under src/app/api/providers/*, letting remote attackers enumerate, create, modify, or delete provider connections, exploit requires no authentication.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-59801.yaml"}
@@ -4350,11 +4400,14 @@
{"ID":"CVE-2026-72898","Info":{"Name":"Metabase - Unauthenticated SQL Injection","Severity":"critical","Description":"Metabase contains a sql injection caused by improper sanitization of input in the '/reset_password' database endpoint, letting remote unauthenticated attackers gain administrator access, exploit requires no special privileges.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-72898.yaml"}
{"ID":"CVE-2026-73034","Info":{"Name":"DB-GPT \u003c= 0.8.1 - Arbitrary File Write","Severity":"critical","Description":"DB-GPT through 0.8.1 allows unauthenticated arbitrary file writes via a path traversal in the user_id HTTP header of the POST /api/v1/python/file/upload endpoint, letting attackers escape the intended upload directory and write files anywhere, as confirmed by the reflected upload path in the JSON response.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-73034.yaml"}
{"ID":"CVE-2026-7467","Info":{"Name":"Read More \u0026 Accordion \u003c= 3.5.7 - Authenticated Privilege Escalation","Severity":"high","Description":"The Read More \u0026 Accordion (expand-maker) plugin for WordPress through 3.5.7 allows privilege escalation due to improper validation in the importData AJAX handler (yrm_import_data action). An authenticated user with plugin access can upload a crafted JSON attachment to insert arbitrary rows into WordPress database tables, including those that control user roles and capabilities, potentially leading to site takeover.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-7467.yaml"}
{"ID":"CVE-2026-75128","Info":{"Name":"Langchain-Chatchat \u003c= 0.3.1.3 - Unauthenticated RCE","Severity":"critical","Description":"Langchain-Chatchat \u003c= 0.3.1.3 contains a command injection caused by unauthenticated access to the /tools/call API endpoint invoking the shell tool, letting remote attackers execute arbitrary OS commands as root, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-75128.yaml"}
{"ID":"CVE-2026-75650","Info":{"Name":"Adobe Commerce/Magento \u003c= 2.4.9 - StyleSmuggler Unauthenticated RCE via SSTI","Severity":"critical","Description":"Adobe Commerce contains a template injection caused by improper neutralization of special elements in the template engine, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-75650.yaml"}
{"ID":"CVE-2026-76268","Info":{"Name":"Splunk Enterprise Patroni REST API - Missing Authentication RCE","Severity":"critical","Description":"Splunk Enterprise versions 10.2.0 through 10.2.6 and 10.4.0 through 10.4.2 expose the Patroni REST API (PostgreSQL sidecar) on SHC members without authentication. An unauthenticated attacker can PATCH /config to set a malicious archive_command and POST /restart to trigger it, achieving remote code execution with the privileges of the PostgreSQL process via the classic Patroni RCE chain.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-76268.yaml"}
{"ID":"CVE-2026-76460","Info":{"Name":"Cisco Identity Services Engine - ise-kong API Gateway Authentication Bypass","Severity":"critical","Description":"Cisco Identity Services Engine contains an authentication bypass caused by insufficient authentication control on an API endpoint, letting unauthenticated remote attackers gain unauthorized access, exploit requires crafted request to API endpoint.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2026/CVE-2026-76460.yaml"}
{"ID":"CVE-2026-76904","Info":{"Name":"GeoServer jsonArrayContains CQL Filter - SQL Injection","Severity":"critical","Description":"GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoTools FilterToSqlHelper.constructEquality writes the expected argument of the jsonArrayContains CQL function RAW into the SQL string while only escaping the JSON pointer. A single quote in the value parameter breaks out of the PostgreSQL jsonb_path_exists string literal, enabling unauthenticated SQL injection. When the PostGIS backend runs with superuser privileges, the injection escalates to operating system command execution through PostgreSQL COPY TO PROGRAM. Patches are available in GeoTools 33.6 and 34.5. No known workaround is available, so the scope can only be limited by restricting which CQL functions are exposed.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-76904.yaml"}
{"ID":"CVE-2026-77806","Info":{"Name":"SPIP \u003c 4.4.22 - Unauthenticated RCE","Severity":"critical","Description":"SPIP \u003c 4.4.21 contains a remote code execution caused by mishandling of the X-Spip-Filtre HTTP request header in analyse_resultat_skel, letting unauthenticated remote attackers execute arbitrary code.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-77806.yaml"}
{"ID":"CVE-2026-7798","Info":{"Name":"WordPress FluentCRM \u003c= 2.9.87 - Unauthenticated Blind SSRF","Severity":"medium","Description":"FluentCRM WordPress plugin \u003c= 2.9.87 contains a blind server-side request forgery caused by improper validation of the 'SubscribeURL' parameter, letting unauthenticated attackers make arbitrary web requests, exploit requires unconfigured SES bounce handling key.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2026/CVE-2026-7798.yaml"}
{"ID":"CVE-2026-7873","Info":{"Name":"Langflow 1.7.2-1.10.0 - Authenticated Remote Code Execution","Severity":"critical","Description":"IBM Langflow OSS 1.0.0 through 1.10.0 contains a command injection caused by insufficient input validation, letting authenticated attackers execute arbitrary OS commands and read sensitive files, exploit requires authentication.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2026/CVE-2026-7873.yaml"}
{"ID":"CVE-2026-80099","Info":{"Name":"Newfold WordPress Plugins - Unauthenticated Admin Bypass via Empty HMAC Secret","Severity":"high","Description":"Newfold Digital WordPress plugins bundling wp-module-data \u003c=2.9.4 allow unauthenticated attackers to forge a valid Bearer token and gain WordPress administrator access. The authenticate() method (hooked on rest_authentication_errors) computes: token = sha256(sha256(wp_json_encode({method,url,body,timestamp})) + sha256(strrev(get_auth_token()))) On sites not connected to Hiive, get_auth_token() returns false; PHP coerces strrev(false) to strrev('') = '', so the HMAC salt collapses to the public constant sha256('') = e3b0c44... All other inputs are attacker-controlled, enabling offline token forgery without any secret knowledge.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-80099.yaml"}
{"ID":"CVE-2026-8037","Info":{"Name":"Progress ADC LoadMaster - Command Injection","Severity":"critical","Description":"OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-8037.yaml"}
{"ID":"CVE-2026-80462","Info":{"Name":"Chef Automate API Gateway - Authentication Bypass","Severity":"critical","Description":"Chef Automate derives an internal service identity from an X.509 certificate supplied in a request header without verifying its issuer. The load balancer blanks X-Client-Cert but does not strip the Grpc-Metadata- prefixed variants, which grpc-gateway rewrites into the metadata key the gateway's auth middleware reads. A remote unauthenticated attacker can present a self-signed certificate naming an internal service such as deployment-service and be authenticated as that service.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2026/CVE-2026-80462.yaml"}
@@ -4376,6 +4429,7 @@
{"ID":"CVE-2026-84434","Info":{"Name":"WordPress Gravity Forms Plugin \u003c=3.1.0.4 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"Gravity Forms WordPress plugin version 3.1.0.4 and earlier contains an unauthenticated arbitrary file upload vulnerability caused by bypassing extension validation in hidden file upload fields. Unauthenticated attackers can upload any file type including PHP when a form has a File Upload field configured with Hidden visibility. The bypass works because the server-side extension validation is skipped for fields with gfield_visibility_hidden CSS class.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-84434.yaml"}
{"ID":"CVE-2026-85097","Info":{"Name":"Bricksforge WordPress Plugin \u003c=3.1.8.9 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"Bricksforge WordPress plugin versions up to and including 3.1.8.9 are vulnerable to unauthenticated arbitrary file upload leading to remote code execution. An attacker obtains a wp_rest nonce via the bricksforge_regenerate_nonce AJAX action, uploads a GIF/PHP polyglot through the form_file_upload REST endpoint with the nonce in the X-WP-Nonce header, then triggers form_submit to copy the file to the WordPress media uploads directory where it executes as PHP. Requires a published Bricks Pro Form with a file field on the target; the post_id, form_id, and field_id template variables must be set accordingly.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-85097.yaml"}
{"ID":"CVE-2026-85200","Info":{"Name":"GEO my WP \u003c=4.5.5.3 - Unauthenticated Local File Inclusion","Severity":"high","Description":"GEO my WP WordPress plugin \u003c= 4.5.5.3 contains a local file inclusion caused by improper handling in gmw_posts_locator_ajax_info_window_loader function, letting unauthenticated attackers execute arbitrary PHP code remotely.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-85200.yaml"}
{"ID":"CVE-2026-85595","Info":{"Name":"Traefik \u003c 2.11.55 / 3.0.0 - 3.7.10 - Digest Authentication Bypass","Severity":"critical","Description":"Traefik \u003c 2.11.55 contains an authentication bypass caused by digestAuth middleware returning empty secret for unknown usernames, letting attackers bypass authentication on digestAuth-protected routes without valid credentials.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-85595.yaml"}
{"ID":"CVE-2026-85688","Info":{"Name":"TEN Framework - Arbitrary File Read \u0026 Write","Severity":"critical","Description":"TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints, letting attackers read or write arbitrary files and execute code. The exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-85688.yaml"}
{"ID":"CVE-2026-85706","Info":{"Name":"GitLab CE/EE \u003c=19.1.7/19.2.5/19.3.1 - Arbitrary File Read","Severity":"critical","Description":"GitLab CE/EE contains an unauthenticated arbitrary file read. Workhorse, the reverse proxy in front of Rails, matches upload routes using EscapedPath() and path.Clean without decoding percent sequences, while Puma decodes them before routing to Grape. Appending a trailing slash to commits or percent-encoding a static path segment as %63ommits therefore bypasses Workhorse upload route rewriting, and Rails reaches file_params_from_body_upload() which opens the path given in the file.path parameter before authenticate! is enforced. On the application/x-www-form-urlencoded branch the file bytes are handed to Rack::Utils.parse_nested_query, and any invalid percent sequence raises an ArgumentError whose message is interpolated into the HTTP 400 response body, disclosing file content to an unauthenticated caller.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-85706.yaml"}
{"ID":"CVE-2026-85714","Info":{"Name":"Stirling PDF \u003c= 2.13.1 - H2 Database Import Remote Code Execution","Severity":"critical","Description":"Stirling-PDF \u003c 2.13.2 contains a command injection caused by insufficient SQL whitelist validation in DatabaseService.validateSqlContent(), letting authenticated administrators execute arbitrary OS commands via crafted SQL files, exploit requires admin authentication and default H2 database with security mode.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-85714.yaml"}
@@ -4392,10 +4446,12 @@
{"ID":"CVE-2026-88062","Info":{"Name":"OmniRoute \u003c 3.8.49 - Unauthenticated RCE","Severity":"critical","Description":"OmniRoute \u003c= 3.8.49 contains a remote code execution caused by insufficient validation of interpreter arguments in the POST /api/acp/agents endpoint, letting remote attackers execute arbitrary code, exploit requires anonymous access when requireLogin is false or management session/API key when true.\n","Classification":{"CVSSScore":"9.5"}},"file_path":"http/cves/2026/CVE-2026-88062.yaml"}
{"ID":"CVE-2026-8839","Info":{"Name":"WordPress MapPress Maps \u003c= 2.96.6 - Unauthenticated IDOR","Severity":"medium","Description":"MapPress Maps for WordPress \u003c= 2.96.6 contains an authorization bypass caused by missing ownership verification in REST API routes, letting unauthenticated attackers read any map data and authenticated contributors modify any map, exploit requires crafted API requests\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-8839.yaml"}
{"ID":"CVE-2026-8857","Info":{"Name":"MediaWiki EasyTimeline - Code Injection RCE","Severity":"high","Description":"MediaWiki EasyTimeline (Timeline) extension versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9 contain a code injection vulnerability caused by insufficient neutralization of newlines in TextData text attributes in EasyTimeline.pl / Timeline.php. A crafted \u003ctimeline\u003e block can inject ploticus '#proc getdata' and 'command:' directives, which execute via /bin/sh because EasyTimeline invokes ploticus without the -noshell flag. Exploitation requires the ability to submit timeline markup for rendering — low-privileged edit access, or anonymous access on wikis that allow anonymous editing and API use. This template's parse-based check needs API read access; optional username/password inputs can be supplied for private wikis that deny anonymous read.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-8857.yaml"}
{"ID":"CVE-2026-88804","Info":{"Name":"SUSE Rancher - Stored XSS via Unauthenticated Settings Override","Severity":"high","Description":"SUSE Rancher supports HTTP method override via the `_method` query parameter in the Norman API framework. Public UI settings routes were intended to be read-only for unauthenticated users, but the method override allows an unauthenticated attacker to perform PUT requests, modifying settings such as `ui-pl` (the product-line branding value). This value is rendered as raw HTML on the Rancher login page (`/dashboard/auth/login`) without sanitization, enabling stored cross-site scripting. Any user who subsequently opens the login page executes the attacker-controlled script in the Rancher origin, potentially leading to administrator session hijacking, bootstrap password disclosure, or full administrative control of the Rancher installation and its downstream clusters.\n","Classification":{"CVSSScore":"9.6"}},"file_path":"http/cves/2026/CVE-2026-88804.yaml"}
{"ID":"CVE-2026-89013","Info":{"Name":"Dolibarr \u003c 24.0.0 - Authorization Bypass via hashp Parameter","Severity":"high","Description":"Dolibarr ERP/CRM versions 23.0.4 through 24.0.0 contain an authorization bypass vulnerability in document.php and viewimage.php. The public share-link feature forces NOLOGIN when hashp is present, but the value 'shared' skips token resolution while the override still fires for any non-empty hashp value. This bypass allows unauthenticated remote attackers to read arbitrary files from all Dolibarr managed directories including logs, SQL database backups, invoices, contracts, user vcards, and custom module sources.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-89013.yaml"}
{"ID":"CVE-2026-89026","Info":{"Name":"Issabel Framework - Hard-Coded PBX API JWT Key","Severity":"critical","Description":"Issabel Framework before commit b97dbaf uses a shared HS256 key for PBX API bearer tokens. This template uses the read-only AMI ExtensionState action to check whether the PBX API accepts a short-lived token signed with either the vulnerable upstream-source key or the key in the 5.0.0-2 RPM, after rejecting an unrelated key.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-89026.yaml"}
{"ID":"CVE-2026-89063","Info":{"Name":"Bookly \u003c=28.1 - IDOR Unauthenticated Sensitive Data Access","Severity":"high","Description":"Bookly WordPress plugin \u003c= 28.1 contains an insecure direct object reference caused by missing validation on 'conversation_id' parameter, letting unauthenticated attackers read and inject messages into any AI booking conversation, exploit requires no authentication.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2026/CVE-2026-89063.yaml"}
{"ID":"CVE-2026-89079","Info":{"Name":"Theme My Login \u003c= 7.2.1 - Privilege Escalation","Severity":"critical","Description":"Theme My Login (TML) \u003c= 7.2.1 for WordPress is vulnerable to unauthenticated account takeover on multisite installations. The multisite-only filter tml_ms_filter_pre_insert_user_data(), hooked on wp_pre_insert_user_data, hashes and injects $_POST['user_pass1'] into the user record whenever the tml_user_passwords network option is enabled, WITHOUT checking the $update flag. During a lost password request (wp-login.php?action=lostpassword -\u003e retrieve_password() -\u003e wp_update_user()), this filter fires on the EXISTING target user, overwriting their password with an attacker-chosen value. An unauthenticated attacker can therefore take over any account, including a network administrator, by sending user_pass1 in the lost-password POST. Fixed in 7.2.2 (changeset 3696081 / commit 06b76231) by adding the $update guard and only applying the password during activation.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-89079.yaml"}
{"ID":"CVE-2026-9062","Info":{"Name":"WordPress Agile Store Locator \u003c 1.6.9 - Arbitrary File Read","Severity":"low","Description":"The Agile Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary .php files from the server.\n","Classification":{"CVSSScore":"3.4"}},"file_path":"http/cves/2026/CVE-2026-9062.yaml"}
{"ID":"CVE-2026-90774","Info":{"Name":"rustypaste \u003c 0.18.1 - Filename Header Path Traversal","Severity":"high","Description":"rustypaste before 0.18.1 contains a path traversal caused by improper validation of the custom filename HTTP header, letting attackers write files outside the upload directory.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-90774.yaml"}
{"ID":"CVE-2026-90817","Info":{"Name":"REDCap \u003e= 13.3.0 - Unauthenticated Remote Code Execution via Survey Passthru","Severity":"critical","Description":"REDCap versions 13.3.0 through 16.0.48 LTS, 17.3.9 LTS, and 17.4.3 Standard contain an unauthenticated remote code execution vulnerability. The application is vulnerable to an authentication bypass via a double-URL-decoded __passthru parameter (%2569ndex.php -\u003e index.php) on public survey endpoints, which routes requests to internal authenticated controllers. An unauthenticated attacker can abuse this routing flaw combined with PHP filter chains to inject and execute arbitrary code through the Laravel Blade template cache.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-90817.yaml"}
{"ID":"CVE-2026-9082","Info":{"Name":"Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query","Severity":"critical","Description":"Drupal core from 8.9.0 before 10.4.10, 10.5.0 before 10.5.10, 10.6.0 before 10.6.9, 11.0.0 before 11.1.10, 11.2.0 before 11.2.12, and 11.3.0 before 11.3.10 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-9082.yaml"}
@@ -4406,12 +4462,18 @@
{"ID":"CVE-2026-9198","Info":{"Name":"IBM Langflow - Remote Code Execution","Severity":"critical","Description":"IBM Langflow OSS 1.0.0 through 1.10.0 contains a remote code execution caused by chaining /api/v1/auto_login and /api/v1/validate/code endpoints, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-9198.yaml"}
{"ID":"CVE-2026-9282","Info":{"Name":"W3 Total Cache \u003c= 2.9.4 - Unauthenticated Arbitrary File Read","Severity":"high","Description":"W3 Total Cache WordPress plugin \u003c= 2.9.4 contains a directory traversal caused by improper handling in setupSources function, letting unauthenticated attackers read arbitrary files, exploit requires manual minify mode enabled with specific filename.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-9282.yaml"}
{"ID":"CVE-2026-9290","Info":{"Name":"WP User Manager – User Profile Builder \u0026 Membership - Local File Inclusion","Severity":"high","Description":"WP User Manager – User Profile Builder \u0026 Membership plugin for WordPress \u003c= 2.9.17 contains a local file inclusion caused by improper handling in the profile template scope function, letting unauthenticated attackers execute arbitrary PHP code, exploit requires ability to upload or control PHP files.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-9290.yaml"}
{"ID":"CVE-2026-93485","Info":{"Name":"WordPress Core \u003c 7.1.1 - Unauthenticated Stored XSS via Comment (Comment2Shell)","Severity":"high","Description":"WordPress core before 7.1.1 is vulnerable to unauthenticated stored XSS via crafted blockquote comments. wp_kses_post accepts a \u003cblockquote\u003e with a literal newline in the cite attribute, wpautop's non-quote-aware regex injects a \u003cp\u003e inside the cite value, and wptexturize leaves the attribute open so onfocus/autofocus land on \u003ccode\u003e as real HTML attributes, giving zero-click stored XSS. Only triggers when comments are open and auto-approved.\n","Classification":{"CVSSScore":"7.1"}},"file_path":"http/cves/2026/CVE-2026-93485.yaml"}
{"ID":"CVE-2026-93616","Info":{"Name":"Check Point Security Management - Unauthenticated Directory Traversal to RCE","Severity":"critical","Description":"Check Point Management Server contains a directory traversal and unrestricted file upload vulnerability allowing unauthenticated attackers to upload and execute arbitrary scripts remotely, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-93616.yaml"}
{"ID":"CVE-2026-93674","Info":{"Name":"Langflow OSS \u003c=1.12.2 - Unauthenticated RCE via Import Code Execution","Severity":"critical","Description":"Langflow OSS 1.0.0 through 1.12.2 is vulnerable to unauthenticated remote code execution via the POST /api/v1/validate/code endpoint, which calls importlib.import_module() on user-supplied import statements, executing module top-level code instead of merely validating syntax.\nCombined with the default LANGFLOW_AUTO_LOGIN=true configuration (which issues a superuser JWT from GET /api/v1/auto_login with no credentials) and the custom_component exec() sink (POST /api/v1/custom_component, which can plant arbitrary Python modules into site-packages), a remote unauthenticated attacker achieves arbitrary OS command execution.\nFixed in 1.12.3 by replacing importlib.import_module() with importlib.util.find_spec() (commit 461506ac2f).\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-93674.yaml"}
{"ID":"CVE-2026-94169","Info":{"Name":"The Grid \u003c= 2.8.1 - Unauthenticated Code Injection","Severity":"critical","Description":"Theme-one The Grid \u003c= 2.8.1 contains a command injection caused by improper control of code generation, letting attackers execute arbitrary commands remotely, exploit requires crafted input.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2026/CVE-2026-94169.yaml"}
{"ID":"CVE-2026-9506","Info":{"Name":"Bagisto \u003c= 2.4.1 - Unauthenticated Arbitrary File Read","Severity":"high","Description":"Bagisto through 2.4.1 is vulnerable to unauthenticated path traversal in the ImageCache controller. The `original` image-cache route (/cache/original/{filename}) passes the user-supplied filename to getImagePath() without any '..' filtering or realpath containment, allowing a remote unauthenticated attacker to read files outside the intended public image directories (upload/images) - for example the application's composer.json, artisan and other source files.\n","Classification":{"CVSSScore":"8.7"}},"file_path":"http/cves/2026/CVE-2026-9506.yaml"}
{"ID":"CVE-2026-9586","Info":{"Name":"Sangoma Switchvox \u003c 8.4.0.2 - Unauthenticated SQL Injection","Severity":"critical","Description":"Sangoma Switchvox before version 8.4.0.2 contains an unauthenticated SQL injection vulnerability in the /pa endpoint (PhoneAppsHandler.pm). The PhoneIP field extracted from an XML POST body is concatenated directly into an unparameterized PostgreSQL query that runs as a database superuser. An attacker can break out of the single-quoted SQL string context and leverage PostgreSQL COPY TO PROGRAM to execute arbitrary operating system commands without authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-9586.yaml"}
{"ID":"CVE-2026-96652","Info":{"Name":"Plex Media Server \u003c 1.43.3.10861 - Unauthenticated SSRF via Companion Protocol (plex2shell)","Severity":"medium","Description":"Plex Media Server \u003c 1.43.3.10861 contains a server side request forgery caused by improper validation of the 'protocol' parameter in /player/timeline, letting attackers with any X-Plex-Token value force the server to POST to arbitrary destinations, exploit requires any X-Plex-Token value.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2026/CVE-2026-96652.yaml"}
{"ID":"CVE-2026-96655","Info":{"Name":"Plex Media Server \u003c 1.43.3.10861 - SSRF via Transcoder","Severity":"medium","Description":"Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-96655.yaml"}
{"ID":"CVE-2026-97229","Info":{"Name":"GitLab CE/EE \u003c 19.2.8 / 19.3.5 / 19.4.2 - Unauthenticated RCE via Onigmo Integer Overflow","Severity":"critical","Description":"GitLab CE/EE 19.2.0–19.2.7, 19.3.0–19.3.4, and 19.4.0–19.4.1 contain a remote code execution caused by insufficient regular expression validation in CI/CD configuration, letting unauthenticated users execute arbitrary code remotely, exploit requires crafted regex in CI/CD config\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-97229.yaml"}
{"ID":"CVE-2026-97359","Info":{"Name":"Rejetto HTTP File Server 2.4.x - Template Injection","Severity":"critical","Description":"Rejetto HTTP File Server (HFS) 2.4.x inserts the multipart upload filename into the server-side template symbol map as %item-resource% without escaping. A filename containing the literal %item-resource% is substituted a second time by the sequential global replacement in xtpl(), allowing a :} sequence to terminate the quoting region so a following {.exec|...} macro is executed as an operating-system command. An unauthenticated attacker achieves remote code execution with a single request.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-97359.yaml"}
{"ID":"CVE-2026-9833","Info":{"Name":"WordPress Tag Groups \u003c 2.2.0 - Reflected Cross-Site Scripting","Severity":"high","Description":"The Tag Groups WordPress plugin \u003c 2.2.0 contains a stored XSS caused by improper escaping of an AJAX parameter reflected in an HTML response, letting unauthenticated attackers execute arbitrary JavaScript in browsers of logged-in users with edit_pages capability, exploit requires victim interaction.\n","Classification":{"CVSSScore":"7.1"}},"file_path":"http/cves/2026/CVE-2026-9833.yaml"}
{"ID":"CVE-2026-9848","Info":{"Name":"WP Ticket \u003c= 6.0.4 - SQL Injection","Severity":"high","Description":"WP Ticket (wp-ticket) for WordPress through 6.0.4 allows unauthenticated SQL injection via front-end search due to unsanitized use of the \"s\" parameter in emd_author_search_results(). Exploitation requires at least one guest ticket. Fixed in 6.0.5.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-9848.yaml"}
{"ID":"CVE-2001-1473","Info":{"Name":"Deprecated SSHv1 Protocol Detection","Severity":"high","Description":"SSHv1 is deprecated and has known cryptographic issues.","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2001/CVE-2001-1473.yaml"}
{"ID":"CVE-2004-0437","Info":{"Name":"Titan FTP Server 3.01 - DoS via LIST Command Disconnection","Severity":"medium","Description":"Titan FTP Server version 3.01 build 163 (and possibly other older versions) contains a vulnerability where disconnecting during a LIST -L command may crash the daemon. Remote attackers can cause denial of service by initiating a LIST -L command and then abruptly disconnecting, leading to server instability.\n","Classification":{"CVSSScore":"5"}},"file_path":"network/cves/2004/CVE-2004-0437.yaml"}
{"ID":"CVE-2004-0656","Info":{"Name":"Pure-FTPd ≤ 1.0.18 - DoS via Connection Limit Exhaustion","Severity":"medium","Description":"Pure-FTPd versions ≤ 1.0.18 are vulnerable to denial of service through connection limit exhaustion. The vulnerability occurs in the accept_client function when the maximum number of connections is exceeded, potentially causing the server to become unresponsive or crash.\n","Classification":{"CVSSScore":"5"}},"file_path":"network/cves/2004/CVE-2004-0656.yaml"}
The default installation of Krpano Panorama Viewer version 1.20.8 and before is prone to reflected cross-site scripting via the xml parameter in krpano.html. When passQueryParameters allows the xml parameter, a remote XML file supplied in the URL is loaded and its embedded Javascript action is executed in the origin of the viewer.
impact:|
An attacker can execute arbitrary Javascript in the victim's browser in the context of the vulnerable site by sending a crafted link, which can lead to session theft or actions performed on behalf of the victim.
remediation:|
Update to the latest Krpano version and set passQueryParameters to a fixed list of parameters that does not include xml, instead of true.
Loaded 100 of 4426 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
ghost