* Update CVE-2026-111497 details and author list
* Uncomment digest line in CVE-2026-111497.yaml
* Update digest line in CVE-2026-111497.yaml
* minor update timeout and request handling in CVE-2026-111497
Reduced INTERIM_TIMEOUT from 5 to 2 seconds and modified the 'attempt' and 'send' functions to use a 'mode' parameter instead of 'probe'. Updated logic for handling streaming and expectations in the request process.
---------
Co-authored-by: Roberto Nunes <[email protected]>
* Add CVE-2026-119495 - Better Search unauthenticated arbitrary post type content disclosure
Better Search before 4.5.3 takes the seamless-mode post_type search argument directly from the request without restricting it to publicly queryable post types (fixed by get_allowed_post_types() in 4.5.3), letting unauthenticated visitors query internal post types such as revisions and disclose draft content through rendered search results. Detection: GET /?s=a&post_type=revision and matching post_type=revision&p= links, which WordPress core get_post_permalink() emits for revision entries rendered by the theme loop. Validated against mock endpoints implementing the diffed 4.5.2/4.5.3 behavior; no live instance available.
* Update CVE-2026-119495.yaml
* Update CVE-2026-119495.yaml
---------
Co-authored-by: maulanawirawan <[email protected]>
Co-authored-by: Aman Rawat <[email protected]>
Co-authored-by: Dhiyaneshwaran <[email protected]>
* Add CVE-2026-120597 - Welcart e-Commerce unauthenticated reflected XSS in ESCOTT error page
Welcart e-Commerce before 2.12.7 reflects the unescaped ResponseCd request parameter in the e-SCOTT settlement error page (esc_html() added in 2.12.7). A plain unauthenticated GET to the cart page with acting_return=1, MerchantFree2=acting_escott_conv and the payload in ResponseCd reaches the sink. Detection: GET /usces-cart/ and /cart/ with those parameters, matching the raw payload reflection that the escaped output no longer contains. Validated against mock endpoints implementing the diffed 2.12.6/2.12.7 behavior; no live instance available.
* Anchor the CVE-2026-120597 matcher to the Welcart error page container
The honeypot check echoes the request URL with decoded query parameters, so a bare reflection matcher matched it. Require the hardcoded error_page_mesage container class alongside the raw reflection; the honeypot response does not contain it, while the vulnerable error page renders it regardless of translation.
* Update CVE-2026-120597.yaml
---------
Co-authored-by: maulanawirawan <[email protected]>
Co-authored-by: Aman Rawat <[email protected]>
* Update atlassian-crowd-panel: match current login title, fix Shodan query and version extractor
### PR Information
- Updated `http/exposed-panels/atlassian-crowd-panel.yaml`
Current Crowd releases (confirmed on 7.2.4) are no longer detected:
- The login title changed to `Atlassian Crowd - Log into Atlassian`. Added it as a second matcher (`or`) next to the legacy title.
- The version moved to the page footer. Relaxed the regex to `Version: ([\d.]+)` so it covers both layouts.
- The shodan-query pointed to Jira. Changed it to `http.component:"atlassian crowd"` and `http.title:"Atlassian Crowd"`.
- Added the `crowd,sso,login` tags.
Path, ID and request count are unchanged.
- References: https://www.atlassian.com/software/crowd
### Template validation
- [x] Validated with a host running a vulnerable version and/or configuration (True Positive)
- [x] Validated with a host running a patched version and/or configuration (avoid False Positive)
#### Additional Details
Before:
```bash
$ nuclei -target "https://crowd.feuerwache-wedel.de" -tags atlassian
[...]
```
After:
```bash
nuclei -target "https://crowd.feuerwache-wedel.de" -tags atlassian
[...]
[atlassian-crowd-panel:version] [http] [info] https://crowd.feuerwache-wedel.de/crowd/console/login.action ["7.2.4"]
```
No matches on Jira, Confluence or generic sites.
* Update atlassian-crowd-panel.yaml
---------
Co-authored-by: Dhiyaneshwaran <[email protected]>
Updated the CVE-2026-12583 entry to clarify the vulnerability details and impact, including the potential for Remote Code Execution. Adjusted matchers and example payloads for better accuracy.
The template matched any Appsmith instance because /api/v1/tenants/current
and /api/v1/consolidated-api/view intentionally stay reachable without
authentication (the login page uses them) and still return a 200 JSON
body after the fix. The fix in appsmithorg/appsmith#41598 (shipped in
v1.98) instead:
- removes instanceId and adminEmailDomainHash from those two responses
for anonymous callers
- makes /api/v1/users/features return 401 for anonymous callers
Split the request so that the first two endpoints only match when one of
the removed fields is present, and /api/v1/users/features only matches
on an unauthenticated 200.
Verified: no match against a patched v1.99 instance (previously matched
on 2 URLs); matches against responses in the pre-fix shape.
Co-authored-by: Claude Fable 5.1 <[email protected]>
* fix(dell-idrac9-detect): require both quoted iDRAC9 keys to avoid matching Apple AirPlay device-info plists
The word matcher matched the substring BuildVersion, which is also
present in osBuildVersion inside Apple AirPlay device-info binary
plists, so any Mac with AirPlay Receiver enabled was detected as a
Dell iDRAC9 (issue #17611). Require both keys quoted exactly as the
iDRAC9 JSON emits them, and drop the stale digest line so the signing
workflow can re-sign on merge.
* Remove condition from Apple AirPlay device-info check
Removed unnecessary condition from device-info check.
* Update dell-idrac9-detect.yaml
---------
Co-authored-by: Roberto Nunes <[email protected]>
Co-authored-by: Dhiyaneshwaran <[email protected]>
* Add CVE-2026-112866 vulnerability details
This YAML file describes a critical SQL injection vulnerability in the Product Filter by WBW plugin for WordPress, detailing the impact, remediation steps, and example requests.
* Update CVE-2026-112866.yaml
* Update CVE-2026-112866.yaml
---------
Co-authored-by: Aman Rawat <[email protected]>
Co-authored-by: Dhiyaneshwaran <[email protected]>
* cisco-meraki-exposure: fix matcher that never matches the current local status page
The template required a rendered sentence that current Meraki firmware
fills in with JavaScript, so it never matched the raw HTML. Match the
page's structural markers instead, and recognise the 307 to the device's
devices.meraki.direct HTTPS status page.
Co-Authored-By: Claude Mythos 5.1 <[email protected]>
* Update cisco-meraki-exposure.yaml
---------
Co-authored-by: Claude Mythos 5.1 <[email protected]>
Co-authored-by: Aman Rawat <[email protected]>
Updated the detection of deprecated SSL/TLS protocols to include SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1. Enhanced remediation steps and added references for better guidance.
Detects if the config page of the Lighter server is exposed, it is an opensource REST application for interacting with Apache Spark on Kubernetes or Apache Hadoop YARN.
* Fixed CVE-2025-54988 Apache Tika XXE template
Replace the version-agnostic echo matcher with an active XFA XXE
file-read proof gated by a vulnerable version check, eliminating
false positives on patched and non-vulnerable Tika instances.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
* Update CVE-2025-54988.yaml
* Update CVE-2025-54988.yaml
---------
Co-authored-by: Claude Opus 4.8 <[email protected]>
Co-authored-by: Ritik Chaddha <[email protected]>
* Fixed CVE-2026-109618 version fallback false negatives
Align the version fallback with the official affected range from
GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp (< 8.2.35, < 8.3.36,
< 8.4.27, < 8.5.12):
- report EOL branches below 8.2 instead of returning null
- run the version fallback when a probe is rejected (e.g. nginx 413)
- treat dev/alpha/beta/RC builds of fixed versions as vulnerable
- read the PHP version from the Server header as well
* Update CVE-2026-109618.yaml
---------
Co-authored-by: Roberto Nunes <[email protected]>
Co-authored-by: Dhiyaneshwaran <[email protected]>
* Add CVE-2026-90817 - REDCap >= 13.3.0 Unauthenticated RCE via Survey Passthru
* Fix CVE-2026-90817 template metadata and request flow
- Remove the malformed first request block (GET {{BaseURL}}&__passthru=...):
for a bare-host target {{BaseURL}} has no query string, so the request
never matched. The survey-hash discovery block now runs first and feeds
{{survey_hash}} into the passthru probe.
- Remove the kev tag: CVE-2026-90817 is not in the CISA KEV catalog
(checked against catalog 2026.10.16, 1748 entries).
- Set verified: false. The matcher has not been exercised against a live
instance; validated locally with nuclei -validate and against a mock.
- Align cwe-id with the CVE record (CWE-73,CWE-94) and set max-request: 4
(the template can send up to 4 requests).
- Add the Securifera advisory to references.
* Update CVE-2026-90817.yaml
---------
Co-authored-by: Aman Rawat <[email protected]>
The detection matcher is a `type: word` matcher whose word is a regular
expression (`^X-Application-Context:\s*\S.+$`). A word matcher does a
literal substring search, so it looks for those bytes verbatim in the
response headers and is always false. With `matchers-condition: and` the
template never matches, even on a host that sends the X-Application-Context
header.
The intended pattern already exists just below, in the extractor
(`(?m)^X-Application-Context:\s*(\S.+)$`). Fold the status and header
checks into one `type: dsl` matcher that runs that regex against the
response headers and keeps the 200 requirement.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
* chore: set author to Securin for CVE-2017-7504
* chore: set author to Securin for CVE-2019-11043
* chore: set author to Securin for CVE-2020-10221
* chore: set author to Securin for CVE-2010-0738
CVE-2026-18315 details the critical unauthenticated authorization bypass vulnerability in the TrueBooker plugin for WordPress, allowing attackers to take over user accounts. The YAML file includes information on the vulnerability, its impact, remediation steps, and references.
The matcher only required `user_email` and `"me"` somewhere in a 200
body. GraphQL servers return 200 for validation errors, and graphql-ruby
echoes the requested field names into the error (`"path":["query","me",
"user_email"]`, `fieldName`), so any graphql-ruby API with a `me` field
whose type lacks `user_email` matched without any bypass taking place.
The json extractor came back empty on those matches.
Require the success shape the bypass returns instead: a `data.me` object
carrying a non-empty `user_email` value. In error bodies `"me"` is only a
`path` array element, never a key holding an object. Stale digest removed
for re-signing.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
* Add CVE-2026-93616
Updated CVE-2026-93616 details including name, description, impact, and remediation steps.
* Add 'passive' tag to CVE-2026-93616.yaml
* Update probe variable to use random text function
Resolve conflict in http/cves/2025/CVE-2025-58443.yaml.
This branch replaces the catch-all detection with a version check against
/fog/service/getversion.php plus a getfiles.php probe; main had meanwhile
refreshed epss-percentile and re-signed the template, and the two sides
disagreed at the tail where this branch removed the old matcher and the
trailing "# digest:" line.
Resolution: keep this branch's rewritten detection in full, take main's
newer epss-percentile, and restore the digest line. The digest is
regenerated by template-sign.yml on push to main.
The template uses the websocket: protocol, not http:, so it does not belong
under http/. This creates websocket/ as the home for websocket-protocol
templates, mirroring how javascript/ and network/ are organised by protocol.
File contents are unchanged.
Hosts that answer every path with a large 200 page matched both branches.
The `/` gate only needed the letters `FOG` anywhere in the body, and the
`(?is)` kernel regex let `.*` span the whole page, so a base64 asset, any
later `configuration`, and dom-serializer's `kernelMatrix` SVG name were
enough. The SSRF branch accepted a DNS-only interaction. Neither request
sent the `X-Requested-With: XMLHttpRequest` header the bypass relies on.
Fingerprint FOG by the bare version string from getversion.php, then send
the header to getfiles.php with an array-valued `path`: vulnerable builds
pass the authorization helper and answer `"Invalid"`, fixed builds return
401. No OAST, no file listing. Stale digest removed for re-signing.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The matcher only required HTTP 200 and the substring `result=0` anywhere in
the body. Hosts that answer every path with a 200 page match whenever that
page contains `result=0`, which the widely bundled `entities` package emits
in minified form (`this.result=0` in EntityDecoder). Such hosts were reported
as a critical backdoor.
Require `result=0` between `<br>` and `</body>`, matching the full response
body documented in the Outpost24 advisory. Whitespace-tolerant so CRLF line
endings still match. Request unchanged; stale digest removed for re-signing.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
* Add gost-socks5-detect and gost-ssh-detect
* Update templates
- Sev: info
- Tags
- References
* Refine GOST SOCKS5 detection simple
Updated the description of the GOST SOCKS5 detection and modified the maximum request limit. Removed the code section and adjusted the matchers for better detection.
* Update gost-ssh-detect.yaml
* Update gost-socks5-detect.yaml
* Update gost-ssh-detect.yaml
* Move gost templates to javascript/detection
Both templates use the javascript: protocol, so they belong under
javascript/ rather than network/. gost-ssh-detect combines tcp: with
javascript: via 'flow: tcp(1) && javascript(1)' - every existing template
using that pattern lives under javascript/ (javascript/cves/2018/CVE-2018-0171,
javascript/enumeration/perforce-user-enum,
javascript/misconfiguration/perforce-remote-depot-unauth), while network/
holds tcp-only flows.
Both are info-severity '-detect' templates, so javascript/detection/ is the
matching subdirectory. File contents are unchanged.
---------
Co-authored-by: Roberto Nunes <[email protected]>
Updated author and description in ldap-metadata.yaml. Enhanced JavaScript code for LDAP enumeration to include TLS port handling and improved metadata extraction.
* Fix Tomcat CVE-2017-12615 and CVE-2017-12617 matchers
Replace static JSP markers with a random multiplication result so a file server that echoes the uploaded body is not reported as vulnerable.
* Skip the Tomcat JSP check unless PUT returns 201
A new file written by this bug is created with 201. If that status is missing, do not send the follow-up request.
#page=N is the PDF open parameter browsers honour when a PDF renders
inline, and a fragment keeps the reference a valid URI.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Google Slides addresses a slide with #slide=id.<objectId>, so the three
slides the note named become three references and the description note
is not needed.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
isms.kisa.or.kr no longer resolves, but the Wayback Machine holds the
guide's post (2024-06-07, with the PDF attached), so the two templates
can reference that instead of prose.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
The guide's hosting page, isms.kisa.or.kr, no longer resolves, and no
page on a live KISA host carries it, so the prose stays until someone
has a link that works.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Strict RFC 3986 validators (protovalidate's string.uri rule, for one)
reject 43 of the 25,949 reference lines in the repository. Fix them:
- links with a typo: a space typed inside the path, a doubled scheme
letter (htttps, hhttps), an escape leaked into the link (&, \#, \web)
- several links on one line: one list item per link
- notes after the link ("(Slide 37,38)", "(test endpoint)"): moved to the
description or dropped
- prose instead of a link: linked the KISA guide and the DOM Invader post
- characters RFC 3986 requires percent-encoded: [ ] " and non-ASCII paths
- a Google Ads tracking URL replaced by the plain site
Digests are left for the signing workflow.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
* Add CVE-2026-55552 - Yamcs <=5.11.12 - Arbitrary File Read
Yamcs resolves a request path beginning with a double slash as an
absolute filesystem path, which discards the static web root and
returns the referenced host file without authentication.
Pairs the unauthenticated /api fingerprint with the file read so the
template does not fire on unrelated hosts that merely serve
passwd-shaped bytes as application/octet-stream, and sets
disable-path-automerge so the leading double slash survives targets
that carry a path.
* Refactor CVE-2026-55552.yaml for clarity and accuracy
Removed EPS score and percentile from CVE metadata. Updated HTTP request path and matchers for improved accuracy.
---------
Co-authored-by: Roberto Nunes <[email protected]>
CVE-2026-29058 details the unauthenticated OS command injection vulnerability in WWBN AVideo Encoder versions prior to 7.0, including its impact, remediation steps, and references.
Updated the description for CVE-2021-37598 to clarify the exploit requirements and modified the max-request value. Added matchers for HTTP requests and refined existing matchers.
Resolve conflict in http/cves/2026/CVE-2026-4257.yaml and correct the path of
the new Crawl4AI template.
The conflict was confined to bot-owned metadata: epss-score/epss-percentile and
the trailing "# digest:" line. The template-body fix this branch carried for
CVE-2026-4257 is already present in main, byte for byte, so main's version is
taken in full and nothing from this branch is lost.
The new template was committed to 'http:/cves/2026/CVE-2026-26216.yaml' - note
the colon after 'http'. That creates a stray top-level 'http:' directory and
makes the repository impossible to check out on Windows, where ':' is reserved.
Moved to http/cves/2026/CVE-2026-26216.yaml with its contents unchanged.
nuclei normalizes a bare trailing `?` away, so both requests in the old
template went out as `GET /wp-json` and were identical. As a result the
template missed the genuine bypass and fired only when a bot-management CDN
returned 403 to the first request and 200 to the second (clearance cookie
replayed) — a false positive unrelated to the plugin.
Rework as a single 3-request check: `/wp-json` must be blocked (403/404),
`/wp-json?x=1` must return the REST API index (200 + JSON), and `/wp-json`
must be blocked again. A query string carries the same trailing-`?`
condition the advisory describes while surviving nuclei's URL normalization,
and the repeated block confirms the access control is actually in force so a
cookie/cache 403->200 flip no longer matches.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
The template only extracts the elFinder version but carried the name,
critical severity, description, remediation and CVSS classification of
the 2.1.58 RCE template. Set it to a version-detect info block; matchers
and extractors unchanged.
Fixes#17349
status_code_1 == 403 && status_code_2 != 403 treated any non-403 response
to the X-Forwarded-For request as a bypass. Tightening to status_code_2 ==
200 drops the 429/3xx/404 challenge cases, but not a CDN that answers the
first request with 403 and a clearance cookie (reused on the next request),
or serves a cached 200 -- there status_code_2 is a genuine 200 that has
nothing to do with the header.
Add a third plain GET / with no X-Forwarded-For and require it to return 403
again, so the header is the only variable between the 200 and the re-403:
status_code_1 == 403 && status_code_2 == 200 && status_code_3 == 403.
This also makes the existing max-request: 3 accurate.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
bcb5e63014 collapsed the title and tab-id matchers into one word list
with condition: or, so any 200 page containing the generic 'status_tab'
id matched. Cisco Meraki device local status pages include
id="status_tab" with an empty <title> and were reported as OutBack
Mate3s. Require both tab ids plus an OutBack-specific marker (the
title or an outbackpower.com link) in a single dsl matcher, and
unwrap the description.
Co-authored-by: Claude Opus 5.5 <[email protected]>
The DSL line `contains(tolower(body), "<title>Munin")` can never be true:
tolower() strips the capital M the needle relies on. Since 64568b24be
added `condition: and` to the matcher, that one dead line blocks the
whole matcher, so the template never fires.
Lowercasing the needle alone is not enough: Munin 2.0's generated
overview page puts the title text on its own indented line
("<title>\n Munin\n </title>"). Use the case-insensitive,
whitespace-tolerant regex idiom already used by sentry-panel.yaml.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The header was written as X-T0KEN-INF0: expr 987843129+808922376. Without spaces, expr receives a single argument and only echoes the literal string instead of evaluating it, so the response header never contains 1796765505 (base64 MTc5Njc2NTUwNQ==) expected by the matcher of the second request, leading to a false negative. Adding spaces lets expr evaluate the arithmetic: expr 987843129 + 808922376.
The matcher required only standard OIDC discovery fields (issuer,
authorization_endpoint, token_endpoint, userinfo_endpoint, jwks_uri),
which every OpenID Connect provider returns. It therefore flagged any
/.well-known/openid-configuration endpoint (Okta, Auth0, Azure AD,
IdentityServer4, etc.) as Keycloak. Require the Keycloak-specific
'protocol/openid-connect' endpoint path so only Keycloak matches.
Secomea GateManager is an OT/industrial remote-access server that brokers
LinkManager and SiteManager connections to plant equipment. No template
existed for it; default scans only report generic TLS/HTTP info on these
hosts. Detection uses two title- and locale-independent structural markers
(the Secomea vendor comment and the /lib/land_gm.png service-selector image)
plus a regex extractor for the product version.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
The Error Log Viewer By WP Guru plugin does not enqueue any frontend
assets, so the homepage fingerprint step (`flow: http(1)`) never
matches and the exploit request is never sent. This causes
false-negatives on every target that has the vulnerable plugin
installed.
Remove the flow directive and the fingerprint step so the template
sends the exploit request directly. The response matchers
(content_type + root regex + status_code) are sufficient to avoid
false-positives.
Gotenberg sanitizes only the keys of the JSON metadata sent to
/forms/pdfengines/metadata/write, so a newline inside a metadata value
reaches ExifTool's stdin and starts a new argument. The template injects
a -Title<${PDFVersion;...} advanced formatting expression and matches the
real command output returned inside the XMP packet of the response PDF.
Verified against vulhub/gotenberg:8.30.1 and gotenberg/gotenberg:8.30.0
(match) and gotenberg/gotenberg:8.31.0 (no match).
CVE-2025-12536.yaml carried cve-id CVE-2025-14437, which NVD lists as a
Hummingbird Performance issue rather than the SureForms one the template
detects.
CVE-2026-76904.yaml carried cve-id CVE-2023-25157 along with that advisory's
tags, upgrade guidance and references, while the detection it implements is the
GeoTools jsonArrayContains injection that NVD lists under CVE-2026-76904.
In both files the epss score already matched the CVE in the filename, so the
classification field was the outlier.
The certenroll matcher passed on any 200 page whose body contained
".cer", ".crt", ".crl" or ".p7b" anywhere plus the word
"certenroll". A single-page app that echoes the requested path, and
has a token such as ".certified" in its markup, satisfies both.
Require an href to a file with one of those extensions instead.
IIS directory listings and nginx/Apache autoindex pages of CertEnroll
still match; the certsrv matcher is unchanged.
Fixes#17314
* Add FoxS (Fox over TLS, 4911) detection to niagara-fox-info-enum
Add a tls:// tcp block on port 4911, require app.name alongside
fox.version so echo services no longer match, and set read-size so
stations that keep the socket open don't stall the request.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
* Update niagara-fox-info-enum.yaml
---------
Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>
Co-authored-by: Roberto Nunes <[email protected]>
Detects the ScienceLogic SL1 (formerly EM7) login console at
/em7/index.em7 using title-independent markers (the login.em7 form
action and css.em7 asset path), so instances with customized page
titles are still detected.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
* Add MCP Streamable HTTP Server - Unauthenticated Initialize
Signed-off-by: devamshah <[email protected]>
* Drop the shodan-query dork from the MCP template
http.html searches the response body, and Mcp-Session-Id only ever
appears as a response header, so the dork could never match. The
fofa-query header= form is correct and stays.
Signed-off-by: Devam Shah <[email protected]>
* Update mcp-streamable-http-exposure.yaml
---------
Signed-off-by: devamshah <[email protected]>
Signed-off-by: Devam Shah <[email protected]>
Co-authored-by: Aman Rawat <[email protected]>
The existing template uses `unsafe: true` which causes nuclei to
duplicate the request path (e.g. `/.%00/WEB-INF/web.xml` becomes
`/.%00/WEB-INF/web.xml/.%00/WEB-INF/web.xml`), resulting in zero
detections on vulnerable Jetty instances.
Changes:
- Replace `unsafe: true` with `disable-path-automerge: true` to
preserve encoded characters without path duplication
- Add `stop-at-first-match: true` since either bypass vector suffices
- Remove `java.sun.com` body matcher — not all web.xml files contain
this string; `</web-app>` is the universal indicator
- Remove unnecessary `Origin` header
Tested against:
- Jetty 9.4.42 (vulnerable): 1 match via .%00 bypass ✓
- Jetty 9.4.43 (patched): 0 matches ✓
- nuclei v3.11.1
The existing template's TCP step requires `maxBsonObjectSize` in the
`buildinfo` response, but that field sits beyond the 2048-byte
`read-size` window — the TCP matcher never fires.
Changes:
- Replace `maxBsonObjectSize` with `gitVersion` (offset 61, well within
2048 bytes) so the version-extraction word matcher actually matches.
- Remove the `javascript` step and `flow` directive: the JS leak-probe
opens ~8 000 TCP connections per scan, requires code-signing, and is
probabilistic (depends on heap state). Version-range detection alone
reliably identifies affected instances.
- Move template from `javascript/` to `network/` (no JS dependency).
- Update `max-request` from 2 to 1.
Verified against MongoDB 8.0.16 (vulnerable — matches) and 8.0.17
(patched — no match).
Fix CVE-2026-63077.yaml — retarget the agent polling protocol (/app/agents/v1) with the documented XStream XML gadget; legacy /app/agents/ probes never fire on affected builds
* feat: add product detection templates
* Delete http/technologies/docuseal-detect.yaml
* chore: remove duplicate detection templates
These 10 products are already fingerprinted by existing templates in
http/exposed-panels/ on the same.
* fix: correct matchers that never fire on real instances
Validated against live hosts; all six previously matched 0/3 and now fire:
kimai real instances render "<title>Kimai - Time Tracking</title>";
exact "<title>Kimai</title>" could never match
cloudron "cloudron-support --owner-login" is injected client-side by JS
and is never present in the GET response body
castopod og:site_name only appears on per-podcast pages, not the instance
root; match title / title= / alt= markers with an or condition
tuleap header and body matchers were ANDed, but host-redirects evaluates
against the final 200 response which does not repeat Set-Cookie;
combine both with an or condition, status still ANDed
geonetwork default deployment chains 3-4 redirects before the matcher strings
appear; max-redirects was 2
defguard the exposed component is usually the Enrollment Service, whose
title differs from the exact "<title>Defguard</title>" required
Co-Authored-By: Claude Opus 5 <[email protected]>
---------
Co-authored-by: Ritik Chaddha <[email protected]>
Co-authored-by: ritikchaddha <[email protected]>
Co-authored-by: Claude Opus 5 <[email protected]>
* add: Qdrant unauthenticated telemetry exposure
Detects Qdrant instances running without service.api_key set, where
GET /telemetry answers unauthenticated and returns the instance UUID,
version, collection count, cluster config and REST/gRPC request stats.
Uses a different request and matcher from unauth-qdrantui.yaml, which
covers GET /collections, so the two do not double-report on the same
target. Anchored on Qdrant-specific telemetry keys rather than a
generic collections keyword.
Signed-off-by: devamshah <[email protected]>
* Update qdrant-telemetry-exposure.yaml
* Update qdrant-telemetry-exposure.yaml
---------
Signed-off-by: devamshah <[email protected]>
Co-authored-by: Ritik Chaddha <[email protected]>
Co-authored-by: Dhiyaneshwaran <[email protected]>
* Add CVE-2026-6639 template
* Revise CVE-2026-6639 details and references
Updated the CVE entry for CVE-2026-6639 to clarify the vulnerability details and remediation steps. Adjusted formatting and added new references.
---------
Co-authored-by: Roberto Nunes <[email protected]>
Resolve conflicts in 2 CVE templates. Both conflicted only on the trailing
"# digest:" line, where main's EPSS updater had refreshed the scores and
re-signed the template while this branch was encoding the payload-bearing
'#' as %23.
Resolution: keep this branch's %23 encoding, take main's newer epss values
and digest. The digest is regenerated by template-sign.yml on push to main.
- http/cves/2020/CVE-2020-22208.yaml
- http/cves/2023/CVE-2023-30258.yaml
The second http block has two requests, so only body_1/body_2 and
status_code_1/status_code_2 exist inside it. The matcher reads
body_3/body_4 and status_code_3/status_code_4, which never resolve, so
the template cannot match even against a confirmed vulnerable host.
Rename the four identifiers to restore detection, and add
stop-at-first-match so a hit is reported once against the path that
actually served the uploaded file rather than twice, with one report
pointing at a path that returned 404.
Drop the stale digest; it is regenerated on merge.
Co-authored-by: Ritik Chaddha <[email protected]>
The template sent admin:admin to /ov.html in a single request and
reported a high severity default login whenever the response was 200 and
contained "Control Panel". Nothing verified that the credentials were
required or accepted.
GUDE devices ship with HTTP password protection disabled, so an untouched
device serves /ov.html to any request and ignores the Authorization
header, which was reported as default credentials that were never used.
"Control Panel" on its own is also generic enough to match unrelated web
panels.
An unauthenticated request is now sent first and must return 401 before
the admin:admin response is evaluated.
431 of the 435 code and javascript templates are signed with the ProjectDiscovery
key 922c64590222798bb761d5b6d8e72950. Four carry a contributor's own key, left
behind by running `nuclei -sign` locally before submitting:
code/cves/2016/CVE-2016-8735.yaml 41987585204b393149694b2205534b1a
code/cves/2020/CVE-2020-13935.yaml 62279eae9ebf191e34eae847adfdbab2
code/cves/2025/CVE-2025-68926.yaml 2592222ea8b5b5922b8de61fd7ebe9f8
code/cves/2025/CVE-2025-71260.yaml 41987585204b393149694b2205534b1a
Nuclei rejects them at load time because the signature does not verify, and the
signing workflow cannot repair them, because re-signing a code template that
already carries a signature is refused outright:
could not sign: cause="re-signing code templates are not allowed for security
reasons."
That guard is correct — it stops CI laundering untrusted contributor code into a
trusted signature — but it means the only remedy is to remove the stale signature
so the official key can be applied. CVE-2025-71260 had been unrunnable since
March 2026.
Dropping the digest line lets Template Sign pick these up on the next push to
main. The four templates are unchanged otherwise; their code was reviewed, and
their tags already reflect their behaviour (dos on CVE-2020-13935, intrusive on
CVE-2025-71260).
Adds a check so this cannot recur silently: any code or javascript template whose
digest carries a non-ProjectDiscovery fingerprint now fails CI at review time,
with the offending files and the remediation command in the output. Templates
with no digest pass, which is the expected state while awaiting signing.
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
The EPSS and KEV workflows rewrite template YAML on a daily schedule, which
invalidates the signature of every file they touch. Signing is expected to
recover via the push trigger on this workflow, but those jobs commit with
GITHUB_TOKEN and GitHub does not start workflows from such pushes, so nothing
re-signs them until the next human merge lands.
Signature verification is only advisory for http and network templates, but
code and javascript templates are refused outright, so they silently stop
loading. On 2026-09-16 this left 18 code and 13 javascript templates unusable,
including CVE-2026-55040 and CVE-2026-83548, both CISA KEV entries.
workflow_run fires regardless of which actor triggered the upstream run, so
chaining off the two metadata workflows restores signatures as soon as they
finish. The sign job itself also pushes with GITHUB_TOKEN, so this cannot
recurse.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Resolve conflict in http/cves/2025/CVE-2025-29927.yaml.
This branch adds the missing matchers-condition to the bypass request; main
had meanwhile tightened the header regex matcher and re-signed the template,
so the two sides disagreed on the trailing "# digest:" line.
Resolution: keep both changes - this branch's matchers-condition and main's
regex matchers - and restore the digest line. The digest is regenerated by
template-sign.yml on push to main.
- Remove chromadb-api-exposure (duplicate of existing chroma-api-exposure)
- Rename exposed-ray-chroma-api to ray-dashboard-exposure
- Add flow + internal:true for multi-step ray template
- Convert all templates to raw requests with DSL matchers
- Add metadata, references, and vendor tags
The existing template uses `unsafe: true` which causes nuclei to
duplicate the request path (e.g. `/.%00/WEB-INF/web.xml` becomes
`/.%00/WEB-INF/web.xml/.%00/WEB-INF/web.xml`), resulting in zero
detections on vulnerable Jetty instances.
Changes:
- Replace `unsafe: true` with `disable-path-automerge: true` to
preserve encoded characters without path duplication
- Add `stop-at-first-match: true` since either bypass vector suffices
- Remove `java.sun.com` body matcher — not all web.xml files contain
this string; `</web-app>` is the universal indicator
- Remove unnecessary `Origin` header
Tested against:
- Jetty 9.4.42 (vulnerable): 1 match via .%00 bypass ✓
- Jetty 9.4.43 (patched): 0 matches ✓
- nuclei v3.11.1
The existing template fails to detect CVE-2018-3760 on vulnerable targets
because nuclei URL-normalizes %2f and %252e in the request path, collapsing
the double-encoded traversal payload before it reaches the server.
Three changes fix the detection:
1. Add `disable-path-automerge: true` to preserve percent-encoded characters
(%2f%2f and %252e%252e) on the wire
2. Split into two request blocks with `flow:` so the extractor from the leak
request runs before the exploit request is built
3. Add `group: 1` to the extractor so only the load path is captured, not
the full error string
Tested against vulhub/rails:5.0.7 (Sprockets 3.7.1 — vulnerable) and
Sprockets 3.7.2 (patched). Matches on vuln, no match on patched.
Improve the GUDE Expert Net Control default-login template.
- Add the user:user factory pair (documented alongside admin:admin in the
vendor manual); switch the hard-coded Basic auth header to clusterbomb
payloads covering both pairs. max-request 1 -> 4.
- Add a regex extractor for device model and firmware from the
"Expert Net Control <model> - v<version>" banner.
- Fix classification: CWE-522 -> CWE-1392 (Use of Default Credentials),
the precise weakness for factory default logins.
- Add ics/ot/iot tags and expand the description.
Verified against a live GUDE Expert Net Control device.
The published template cannot detect a vulnerable Apache Cocoon instance:
1. It POSTs to /v2/api/product/manger/getInfo — a hardcoded path from an
unrelated product. Cocoon routes are defined by its sitemap; this path
404s. Changed to samples/process-order, a sample pipeline shipped with
Cocoon that invokes StreamGenerator (see reference links in template).
2. The XML declaration is inside an HTML comment (<!--?xml ... ?-->),
which is not valid XML. Fixed to <?xml version="1.0"?>.
Verified against real Cocoon 2.1.12 (vuln) and 2.1.13 (patched) builds
from official Apache source tarballs.
Replaces the destructive 'cat /etc/passwd' payload with a harmless echo that
still executes code through the vulnerable Form API render array, and fixes a
false negative caused by matching Content-Type: application/json (the response
is text/html once command output is written to the body). Reflection-proof:
the joined randstr token only appears on real command execution.
Verified against vulhub/drupal:8.5.0 (match) and patched Drupal 8.5.11
(no match), nuclei v3.11.1, 5 runs each.
* Add CVE-2026-23693 (ElementsKit Lite <3.7.9 unauthenticated Mailchimp proxy)
Detects CVE-2026-23693, a missing-authorization (CWE-306) flaw in the ElementsKit Elementor Addons Lite (elementskit-lite) WordPress plugin before 3.7.9. The REST route /wp-json/elementskit/v1/widget/mailchimp/subscribe is registered without any authentication or capability check, so an unauthenticated attacker can drive Mailchimp API requests through the site (client-supplied credentials, insufficient `list` validation) — an open-proxy and API-quota-abuse condition.
Detection is behavioral rather than version-based: an unauthenticated POST is accepted (HTTP 200, application/json) on vulnerable versions, while 3.7.9+ rejects it (401 rest_forbidden). The probe sends bogus Mailchimp credentials so no real account or quota is touched.
Validated on a live LocalWP install: elementskit-lite 3.7.8 matched; 3.7.9 and later did not.
* Update CVE-2026-23693.yaml
---------
Co-authored-by: Ritik Chaddha <[email protected]>
* Add Proxmox VE default login vulnerability YAML
Added a YAML file for Proxmox VE default credentials with TFA bypass vulnerability details, including HTTP request and matchers.
* Update and rename http/default-logins/proxmox-ve-default-login.yaml to http/cves/2023/CVE-2023-54391.yaml
* Update CVE-2023-54391.yaml
---------
Co-authored-by: Dhiyaneshwaran <[email protected]>
The template matched only '<title>Login | CALDERA</title>'. That title is
served by the 4.x line, where the root path routes to the landing handler and
renders login.html server-side with a 200 response.
Caldera 5.0 moved the web interface to the Vue-based Magma plugin. The root
path now returns the SPA shell titled '<title>Magma | Caldera</title>' and the
login form is drawn client-side, so the previous signature is absent from the
response body and 5.x instances were missed entirely.
Add the Magma title next to the existing one under condition: or, leaving the
status matcher and request count unchanged. The title is identical across
5.0.0, 5.1.0, 5.2.0 and 5.3.0, and the 4.x rendering path is unchanged in
4.0.0, 4.1.0 and 4.2.0, so both lines stay covered.
Validated against local instances: 4.2.0 still matches (no regression) and
5.3.0, previously undetected, is now reported. No match on unrelated web
applications used as false-positive controls.
- Move from http/iot/ to http/technologies/ (standard location for tech detect)
- Add classification CPE, vendor/product metadata, shodan/fofa queries
- Update description to past tense with block scalar format
- Add host-redirects, tech/detect/discovery tags
Refine http(1) baseline matchers to verify that the redirect target is an auth-related
location (auth/login/signin/admin/unauthorized), preventing benign Next.js i18n locale
redirects (e.g. / -> /en) from triggering false positive critical findings in base_check.
Closes#17019
Tutor LMS before 4.0.6 extracts request data into the template scope, so an
unauthenticated POST to tutor_course_filter_ajax overwrites the $template
local in tutor_load_template() and then $method_map/$context inside
single-content-loader, reaching an arbitrary zero-argument function call.
The template invokes phpinfo() and matches its output, proving exploitation
rather than reading the installed version. Verified against 4.0.5 (match) and
against 4.0.6, 4.0.7 and a WordPress instance without the plugin (no match).
The second http block has two matchers, a negative matcher for WAF block
pages and a status 200 check, but no matchers-condition, so nuclei falls
back to or. On a patched host the negative matcher alone satisfies the
block; on a WAF block page the status check alone does. base_check()
returns true either way and the template reports critical.
Block 5 already expresses the same two conditions as one dsl matcher with
condition: and, so the intended semantics are unambiguous.
Fixes the false positive reported in #17019, and the one in #16782 which
was closed as fixed but still reproduces.
matchers-condition was set to or across a word matcher, a Set-Cookie
regex, and a bare status:200 matcher. Because status 200 alone is
enough under or, the template flags any successful HTTP response to
the login POST as a confirmed default-login vulnerable printer, even
a failed-login page reload, which HP EWS also serves with status 200.
Changed to and so a match now requires the admin-session body
evidence, the session cookie, and status 200 together.
Resolve conflict in http/cves/2024/CVE-2024-52433.yaml.
This branch rewrites the PHP object-injection payload and matcher; main had
meanwhile refreshed the template's EPSS scores and re-signed it, so the two
sides disagreed on the trailing "# digest:" line.
Resolution: keep this branch's payload and matcher fix, take main's newer
epss-score and epss-percentile, and restore the digest line. The digest is
regenerated by template-sign.yml on push to main.
- CVE-2021-41419, CVE-2024-20404, CVE-2024-2862, CVE-2025-1023:
restore dropped vkev tag, remove extra blank line
- unauth-java-message-broker-detect: fix broken line split and
trailing CR, use vuln instead of discovery
All 592 files now differ from upstream/main only by the appended
vuln or discovery tag.
Exposures and misconfigurations are vulnerabilities, not discovery.
- 6 files: replaced discovery with vuln (exposures/apis, exposures/configs,
misconfiguration/administrate-dashboard)
- 5 files: removed duplicate discovery tag where vuln already present
(xampp-phpinfo, unauth-akhq/hawkeye/phoenix/supervisor dashboards)
Kept discovery on javascript/udp/misconfiguration/mdns-enum.yaml
as mDNS enumeration is legitimately discovery.
The kval extractor depends on this header for version extraction.
Using contains_any allowed matches on instances with only
X-Dawarich-Response, resulting in detection without version output.
Switch from regex to json extractor with JQ path '.version'
so only the top-level version field is extracted, avoiding
duplicate matches from other version-like keys in the response.
Crawl4AI versions prior to 0.8.0 are vulnerable to unauthenticated remote code execution via the hooks parameter in the Docker API deployment. The vulnerability allows attackers to execute arbitrary commands, leading to full server compromise.
Updated the CVE-2026-42878 entry to improve clarity and accuracy of the description, impact, and remediation sections. Changed metadata verification status to true.
Detects Dawarich via the unauthenticated /api/v1/health endpoint, which
returns X-Dawarich-Response and X-Dawarich-Version headers and a status
payload. Version is extracted from the X-Dawarich-Version header.
The key parameter of the legacy /q graphing endpoint is written into the
gnuplot script without validation, so an unauthenticated request can append
a gnuplot system() directive and run commands on the host.
This is the incomplete fix for CVE-2020-35476, which only constrained
yrange. The existing CVE-2020-35476 template does not cover it: on 2.4.1
its yrange payload is rejected with HTTP 400 and nothing executes.
Detection reads an existing metric name from /api/suggest first, since the
graph handler returns HTTP 500 without one, and confirms execution through
an out-of-band interaction rather than the response body alone.
The management plugin's obsolete /api/auth handler returns true from
is_authorized/2, so it serves anonymous callers, and produce_auth_settings/2
serialises management.oauth_client_secret into the response.
Matching the oauth_client_secret key alone is sound: the key is omitted
entirely when no secret is configured, and a broker configured with an empty
secret refuses to start, so the key is only ever present with a real value.
The fix removes the route, so patched brokers answer 404.
CVE-2026-41042 describes a critical vulnerability in Apache Gravitino that allows unauthenticated remote code execution via a specific endpoint. The YAML file includes details about the vulnerability, its impact, remediation steps, and example HTTP requests.
username and password were referenced in both requests but never declared in
variables:, so a run without -var sent an empty 'Basic Og==' header. Nexus does
not accept that as a stateless credential, the request falls through to the
anti-CSRF filter, and the template surfaced 'Anti cross-site request forgery
token mismatch' instead of the finding - which is what @DhiyaneshGeek hit.
Both are now declared, defaulting to the delegated repo-admin account from the
reference lab, and the description states the requirement.
Printer templates that actively exploit or authenticate now carry the
`intrusive` tag, so they can be excluded from non-invasive scans:
- 18 CVEs (Kyocera, Lexmark, PaperCut, Sharp, Brother, Honeywell PM43,
Ricoh, Canon Catwalk, Repetier, TITool PrintMonitor, CUPS)
- 10 misconfiguration/exposure (HP, AMR, OctoPrint, MFP eSCL, Repetier,
Brother, Dell, PJL info leak)
- 5 vulnerabilities (IBM InfoPrint, C-Lodop, Kyocera, PaperCut log4j, Sharp)
- 10 default-logins (Canon, Fuji Xerox, HP, Ricoh, Samsung, Sato,
Toshiba TopAccess, Xerox x2, Zebra) - these POST credentials and can
trigger device lockout
Tag is inserted before the trailing `vuln` tag to match existing
convention. Detection-only templates are deliberately untouched:
exposed-panels, technologies, and the iot/ detect templates. Also skipped
CVE-2026-4480 (tagged `passive`, SMB banner check only).
ulap.php is reachable without WordPress bootstrapping or authentication and
validates only the host of the supplied URL, never the scheme, so a
file://localhost/ URL passes the allowlist and is read back through the
file:// wrapper.
Detection is a single unauthenticated GET matched on the /etc/passwd oracle.
A patched 3.1 install still answers 200 with an error body, so the status code
alone is not a discriminator and the regex carries the match.
W3 Total Cache <= 2.9.3 bypasses its output buffering pipeline for any
request whose User-Agent header contains "W3 Total Cache", without
authenticating the caller. On sites with fragment caching enabled and
existing dynamic fragment tags, this leaks the raw mfunc/mclude
comments including the per-site W3TC_DYNAMIC_SECURITY token.
Detection confirms the plugin version via readme.txt, then confirms
the token leaks in the homepage response when the User-Agent bypass
is used.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Tz1bTiCPJYp7e4j2RFk2BA
The official Gitea Docker image <= 1.26.2 ships with
REVERSE_PROXY_TRUSTED_PROXIES set to a wildcard, so it trusts the
X-WEBAUTH-USER reverse-proxy header from any source. An unauthenticated
attacker can impersonate any user, including admins, by sending that
header. Template confirms baseline 401 on /api/v1/user, then confirms
the spoofed identity is honored (200, login/is_admin reflect the
injected header).
Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Tz1bTiCPJYp7e4j2RFk2BA
FUXA <= 1.2.9 exposes an unauthenticated POST /api/upload that
concatenates the JSON body's destination field into a filesystem path
without normalization, allowing path traversal out of the app
directory. Template writes a random marker file into the public
client/dist web root and confirms it via an unauthenticated GET,
proving the arbitrary-write primitive without touching cron/SSH/RCE
escalation paths.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Tz1bTiCPJYp7e4j2RFk2BA
Crawl4AI Docker API <= 0.8.6 signs/verifies JWTs with a hardcoded
default secret ("mysecret"), letting an unauthenticated attacker forge
a Bearer token accepted by every protected endpoint. Template confirms
the baseline 401 without a token, then forges an HS256 token with the
known secret via generate_jwt() and verifies access to /config/dump.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Tz1bTiCPJYp7e4j2RFk2BA
Unauthenticated SSRF in Kan's /api/download/attatchment endpoint
(<= 0.5.4) via the unvalidated url query parameter. Detection uses an
interactsh OOB callback to confirm the outbound request without
reading any internal data.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Tz1bTiCPJYp7e4j2RFk2BA
Nuclei correctly strips URL fragments (per RFC 3986) before sending
requests, so a literal '#' used as a SQL/shell comment terminator inside
a query string never reaches the target. Percent-encoding it as %23
sends the byte on the wire without needing unsafe: true.
- CVE-2020-22208: MySQL comment '#' -> '%23' (truncates trailing query)
- CVE-2023-30258: shell comment '#' -> '%23' (both http(1)/http(2) paths)
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Add a nuclei HTTP template for CVE-2026-0558 affecting parisneo/lollms
up to 2.2.0.
The template sends a low-impact unauthenticated multipart text upload to
/api/files/extract-text and verifies that the server processes the file by
checking for a JSON text_content response containing a random marker.
References include the Huntr report, NVD entry, and upstream patch commit.
@@ -38,6 +39,7 @@ Along with the P.O.C following are the required fields in the info section for s
- Make sure to add more than one matcher to prevent false positive results. Avoid short word that could be encountered anywhere
- If possible submit the vulnerable environment based on docker-compose. For example: https://github.com/vulhub/vulhub.
- We only accept templates with complete P.O.Cs instead of just detection based on version
- Keep existing `# digest:` lines intact when updating templates — the repository signing workflow will automatically regenerate signatures upon merge
**Don’t**
@@ -45,6 +47,7 @@ Along with the P.O.C following are the required fields in the info section for s
- Avoid submitting templates with weak matchers. For example: Adding GET/POST data as the matchers in the template, as it can result in false positive results on few hosts
- Don’t make unnecessary changes to the existing templates like adding more requests to the templates when the existing requests or paths are good enough to verify that the bug exists
- Try to keep the requests per template as low as possible
- Don't delete or manually edit the `# digest:` line, and do not sign templates with personal keys
**Best Practices**
@@ -58,6 +61,19 @@ Along with the P.O.C following are the required fields in the info section for s
- We should only upload a web shell as a last resort to validate the vulnerability, and if we do upload a file, make sure the file name is random(`{{randstr}}`)
- Do not include code templates for exploits that can be written using HTTP or JavaScript. We avoid adding additional exploit code to the project unless there is an exception.
### **Template Signing and the `# digest:` Line**
Official templates in this repository include a trailing `# digest:` line (for example, `# digest: 4a0a...:922c...`). This is an automated cryptographic signature and public-key fingerprint used by Nuclei to verify template integrity and authenticity.
- **What it is**: It is an automated signature marker generated by ProjectDiscovery, not a comment or obsolete metadata.
- **Do not edit or delete it**: When updating existing templates, leave the existing `# digest:` line as-is. Do not hand-edit or remove it.
- **Automated Signing**: When a pull request is merged into `main`, the automated **Template Sign** workflow automatically calculates and updates the signature for all modified templates using ProjectDiscovery's official signing key.
- **New Templates**: New templates should be submitted without any `# digest:` line. They will be signed automatically upon merge.
- **Do not sign with personal keys**: Never sign contributed templates with your own private key. Specifically, `code` and `javascript` templates signed with non-ProjectDiscovery keys will fail CI validation (`Signing Key Check`) because Nuclei restricts re-signing code protocol templates for security reasons.
- **Signature verification at scan time**:
- For standard protocols (`http`, `dns`, `network`, etc.), Nuclei verifies signatures against trusted keys and displays a warning if a template is unsigned or modified.
- For `code` and `javascript` protocols, valid signatures from trusted keys are mandatory for security. Nuclei will refuse to execute untrusted or improperly signed code templates by default.
- "contains_all(stderr, 'read tcp', 'i/o timeout') && !contains(stderr, 'websocket: close 1002 (protocol error): An invalid WebSocket frame was received - the most significant bit of a 64-bit payload was illegally set')"
{"ID":"CVE-2010-0219","Info":{"Name":"Apache Axis2 Default Login","Severity":"critical","Description":"Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service.","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2010/CVE-2010-0219.yaml"}
{"ID":"CVE-2010-0467","Info":{"Name":"Joomla! Component CCNewsLetter - Local File Inclusion","Severity":"medium","Description":"A directory traversal vulnerability in the ccNewsletter (com_ccnewsletter) component 1.0.5 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter in a ccnewsletter action to index.php.","Classification":{"CVSSScore":"5.8"}},"file_path":"http/cves/2010/CVE-2010-0467.yaml"}
{"ID":"CVE-2010-0696","Info":{"Name":"Joomla! Component Jw_allVideos - Arbitrary File Retrieval","Severity":"medium","Description":"A directory traversal vulnerability in includes/download.php in the JoomlaWorks AllVideos (Jw_allVideos) plugin 3.0 through 3.2 for Joomla! allows remote attackers to read arbitrary files via a ./../.../ (modified dot dot) in the file parameter.","Classification":{"CVSSScore":"5"}},"file_path":"http/cves/2010/CVE-2010-0696.yaml"}
{"ID":"CVE-2010-0738","Info":{"Name":"JBoss JMX/Web Console - Authentication Bypass via HTTP Verb Tampering","Severity":"critical","Description":"JBoss EAP 4.2 (before 4.2.0.CP09) and 4.3 (before 4.3.0.CP08) only enforce authentication for GET/POST on the JMX and Web consoles because the web.xml security-constraint enumerates only those verbs in \u003chttp-method\u003e. Non-standard verbs such as HEAD skip the constraint, granting unauthenticated access to MBean operations (which can lead to remote code execution).\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2010/CVE-2010-0738.yaml"}
{"ID":"CVE-2010-0759","Info":{"Name":"Joomla! Plugin Core Design Scriptegrator - Local File Inclusion","Severity":"high","Description":"A directory traversal vulnerability in plugins/system/cdscriptegrator/libraries/highslide/js/jsloader.php in the Core Design Scriptegrator plugin 1.4.1 for Joomla! allows remote attackers to read, and possibly include and execute, arbitrary files via directory traversal sequences in the files[] parameter.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2010/CVE-2010-0759.yaml"}
{"ID":"CVE-2010-0942","Info":{"Name":"Joomla! Component com_jvideodirect - Directory Traversal","Severity":"medium","Description":"Directory traversal vulnerability in the jVideoDirect (com_jvideodirect) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.","Classification":{"CVSSScore":"5"}},"file_path":"http/cves/2010/CVE-2010-0942.yaml"}
{"ID":"CVE-2010-0943","Info":{"Name":"Joomla! Component com_jashowcase - Directory Traversal","Severity":"medium","Description":"A directory traversal vulnerability in the JA Showcase (com_jashowcase) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter in a jashowcase action to index.php.","Classification":{"CVSSScore":"5"}},"file_path":"http/cves/2010/CVE-2010-0943.yaml"}
@@ -80,6 +81,7 @@
{"ID":"CVE-2010-1352","Info":{"Name":"Joomla! Component Juke Box 1.7 - Local File Inclusion","Severity":"medium","Description":"A directory traversal vulnerability in the JOOFORGE Jutebox (com_jukebox) component 1.0 and 1.7 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.","Classification":{"CVSSScore":"5"}},"file_path":"http/cves/2010/CVE-2010-1352.yaml"}
{"ID":"CVE-2010-1353","Info":{"Name":"Joomla! Component LoginBox - Local File Inclusion","Severity":"medium","Description":"A directory traversal vulnerability in the LoginBox Pro (com_loginbox) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.","Classification":{"CVSSScore":"5"}},"file_path":"http/cves/2010/CVE-2010-1353.yaml"}
{"ID":"CVE-2010-1354","Info":{"Name":"Joomla! Component VJDEO 1.0 - Local File Inclusion","Severity":"medium","Description":"A directory traversal vulnerability in the VJDEO (com_vjdeo) component 1.0 and 1.0.1 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.","Classification":{"CVSSScore":"5"}},"file_path":"http/cves/2010/CVE-2010-1354.yaml"}
{"ID":"CVE-2010-1428","Info":{"Name":"Red Hat JBoss - Web/JMX Console Access","Severity":"high","Description":"Red Hat JBoss Enterprise Application Platform (EAP) can expose the Web Console, JMX Console, and JMXInvokerServlet without authentication, allowing remote attackers to reach admin dashboards and interact with MBeans, leading to full server compromise.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2010/CVE-2010-1428.yaml"}
{"ID":"CVE-2010-1429","Info":{"Name":"Red Hat JBoss Enterprise Application Platform - Sensitive Information Disclosure","Severity":"medium","Description":"Red Hat JBoss Enterprise Application Platform 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 is susceptible to sensitive information disclosure. A remote attacker can obtain sensitive information about \"deployed web contexts\" via a request to the status servlet, as demonstrated by a full=true query string. NOTE: this issue exists because of a CVE-2008-3273 regression.\n","Classification":{"CVSSScore":"5"}},"file_path":"http/cves/2010/CVE-2010-1429.yaml"}
{"ID":"CVE-2010-1461","Info":{"Name":"Joomla! Component Photo Battle 1.0.1 - Local File Inclusion","Severity":"medium","Description":"A directory traversal vulnerability in the Photo Battle (com_photobattle) component 1.0.1 for Joomla! allows remote attackers to read arbitrary files via the view parameter to index.php.","Classification":{"CVSSScore":"5"}},"file_path":"http/cves/2010/CVE-2010-1461.yaml"}
{"ID":"CVE-2010-1469","Info":{"Name":"Joomla! Component JProject Manager 1.0 - Local File Inclusion","Severity":"medium","Description":"A directory traversal vulnerability in the Ternaria Informatica JProject Manager (com_jprojectmanager) component 1.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2010/CVE-2010-1469.yaml"}
@@ -509,11 +511,13 @@
{"ID":"CVE-2017-6478","Info":{"Name":"MaNGOSWebV4 \u003c 4.0.8 - Cross-Site Scripting","Severity":"medium","Description":"paintballrefjosh/MaNGOSWebV4 \u003c 4.0.8 contains a reflected XSS caused by unsanitized input in install/index.php (step parameter), letting attackers execute arbitrary scripts in the victim's browser, exploit requires victim to visit a maliciously crafted URL\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-6478.yaml"}
{"ID":"CVE-2017-7269","Info":{"Name":"Windows Server 2003 \u0026 IIS 6.0 - Remote Code Execution","Severity":"critical","Description":"Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in the ScStoragePathFromUrl function in the WebDAV service that could allow remote attackers to execute arbitrary code via a long header beginning with \"If \u003chttp://\" in a PROPFIND request.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-7269.yaml"}
{"ID":"CVE-2017-7391","Info":{"Name":"Magmi 0.7.22 - Cross-Site Scripting","Severity":"medium","Description":"Magmi 0.7.22 contains a cross-site scripting vulnerability due to insufficient filtration of user-supplied data (prefix) passed to the magmi-git-master/magmi/web/ajax_gettime.php URL.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-7391.yaml"}
{"ID":"CVE-2017-7504","Info":{"Name":"JBossMQ HTTP Invocation Layer (HTTPServerILServlet) - Unauthenticated Java Deserialization","Severity":"critical","Description":"The JMS over HTTP Invocation Layer in JBossMQ, as implemented in HTTPServerILServlet.java in JBoss Application Server (AS) 4.x and earlier, does not properly restrict the classes that can be deserialized from the raw POST body. This allows remote attackers to execute arbitrary code or cause a denial of service (application crash or other impacts) via crafted serialized objects, due to insecure Java object deserialization.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-7504.yaml"}
{"ID":"CVE-2017-7615","Info":{"Name":"MantisBT \u003c=2.30 - Arbitrary Password Reset/Admin Access","Severity":"high","Description":"MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2017/CVE-2017-7615.yaml"}
{"ID":"CVE-2017-7855","Info":{"Name":"IceWarp WebMail 11.3.1.5 - Cross-Site Scripting","Severity":"medium","Description":"IceWarp WebMail 11.3.1.5 is vulnerable to cross-site scripting via the language parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-7855.yaml"}
{"ID":"CVE-2017-7921","Info":{"Name":"Hikvision - Authentication Bypass","Severity":"critical","Description":"Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices contain an improper authentication issue. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2017/CVE-2017-7921.yaml"}
{"ID":"CVE-2017-7925","Info":{"Name":"Dahua Security - Configuration File Disclosure","Severity":"critical","Description":"A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX, DH-SD6CXX, DH-NVR1XXX, DH-HCVR4XXX, DH-HCVR5XXX, DHI-HCVR51A04HE-S3, DHI-HCVR51A08HE-S3, and DHI-HCVR58A32S-S2 devices. The password in configuration file vulnerability was identified, which could lead to a malicious user assuming the identity of a privileged user and gaining access to sensitive information.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-7925.yaml"}
{"ID":"CVE-2017-8046","Info":{"Name":"Spring Data REST \u003c 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution","Severity":"critical","Description":"Spring Data REST \u003c 2.6.9 and 3.0.1, Spring Boot \u003c 1.5.9 and 2.0 M6 contain a remote code execution caused by processing malicious PATCH requests with crafted JSON data, letting attackers execute arbitrary Java code, exploit requires sending malicious PATCH requests.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-8046.yaml"}
{"ID":"CVE-2017-8225","Info":{"Name":"GoAhead Camera - Credential Disclosure","Severity":"critical","Description":"GoAhead camera credential disclosure vulnerability in system.ini. The vulnerability affects certain Wireless IP Camera (P2P) WIFICAM devices and allows unauthenticated remote attackers to access the system.ini configuration file through a crafted HTTP request. The exposed configuration may contain sensitive authentication credentials, including usernames and passwords.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-8225.yaml"}
{"ID":"CVE-2017-8229","Info":{"Name":"Amcrest IP Camera Web Management - Data Exposure","Severity":"critical","Description":"Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download the administrative credentials.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-8229.yaml"}
{"ID":"CVE-2017-8917","Info":{"Name":"Joomla! \u003c3.7.1 - SQL Injection","Severity":"critical","Description":"Joomla! before 3.7.1 contains a SQL injection vulnerability. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2017/CVE-2017-8917.yaml"}
{"ID":"CVE-2017-9140","Info":{"Name":"Reflected XSS - Telerik Reporting Module","Severity":"medium","Description":"Cross-site scripting vulnerability in Telerik.ReportViewer.WebForms.dll in Telerik Reporting for ASP.NET WebForms Report Viewer control before R1 2017 SP2 (11.0.17.406) allows remote attackers to inject arbitrary web script or HTML via the bgColor parameter to Telerik.ReportViewer.axd.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2017/CVE-2017-9140.yaml"}
@@ -701,7 +705,7 @@
{"ID":"CVE-2018-7422","Info":{"Name":"WordPress Site Editor \u003c=1.1.1 - Local File Inclusion","Severity":"high","Description":"WordPress Site Editor through 1.1.1 allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2018/CVE-2018-7422.yaml"}
{"ID":"CVE-2018-7467","Info":{"Name":"AxxonSoft Axxon Next - Local File Inclusion","Severity":"high","Description":"AxxonSoft Axxon Next suffers from a local file inclusion vulnerability.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2018/CVE-2018-7467.yaml"}
{"ID":"CVE-2018-7490","Info":{"Name":"uWSGI PHP Plugin Local File Inclusion","Severity":"high","Description":"uWSGI PHP Plugin before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, making it susceptible to local file inclusion.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2018/CVE-2018-7490.yaml"}
{"ID":"CVE-2018-7600","Info":{"Name":"Drupal - Remote Code Execution","Severity":"critical","Description":"Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-7600.yaml"}
{"ID":"CVE-2018-7600","Info":{"Name":"Drupal - Remote Code Execution","Severity":"critical","Description":"Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-7600.yaml"}
{"ID":"CVE-2018-7602","Info":{"Name":"Drupal - Remote Code Execution","Severity":"critical","Description":"Drupal 7.x and 8.x contain a remote code execution vulnerability that exists within multiple subsystems. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2018/CVE-2018-7602.yaml"}
{"ID":"CVE-2018-7653","Info":{"Name":"YzmCMS v3.6 - Cross-Site Scripting","Severity":"medium","Description":"In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2018/CVE-2018-7653.yaml"}
{"ID":"CVE-2018-7662","Info":{"Name":"CouchCMS \u003c= 2.0 - Path Disclosure","Severity":"medium","Description":"CouchCMS \u003c= 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpmailer/phpmailer.php.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2018/CVE-2018-7662.yaml"}
@@ -743,6 +747,7 @@
{"ID":"CVE-2019-10717","Info":{"Name":"BlogEngine.NET 3.3.7.0 - Local File Inclusion","Severity":"high","Description":"BlogEngine.NET 3.3.7.0 allows /api/filemanager local file inclusion via the path parameter\n","Classification":{"CVSSScore":"7.1"}},"file_path":"http/cves/2019/CVE-2019-10717.yaml"}
{"ID":"CVE-2019-10758","Info":{"Name":"mongo-express Remote Code Execution","Severity":"critical","Description":"mongo-express before 0.54.0 is vulnerable to remote code execution via endpoints that uses the `toBSON` method and misuse the `vm` dependency to perform `exec` commands in a non-safe environment.","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2019/CVE-2019-10758.yaml"}
{"ID":"CVE-2019-11013","Info":{"Name":"Nimble Streamer \u003c=3.5.4-9 - Local File Inclusion","Severity":"medium","Description":"Nimble Streamer 3.0.2-2 through 3.5.4-9 is vulnerable to local file inclusion. An attacker can traverse the file system to access files or directories that are outside of the restricted directory on the remote server.","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2019/CVE-2019-11013.yaml"}
{"ID":"CVE-2019-11043","Info":{"Name":"PHP-FPM Path Info Buffer Underflow - Remote Code Execution","Severity":"critical","Description":"In PHP-FPM before 7.1.33, 7.2.x before 7.2.24, and 7.3.x before 7.3.11, when deployed in certain Nginx configurations with the fastcgi_split_path_info directive, a crafted request with an empty PATH_INFO can trigger a buffer underflow in the php-fpm code. This may allow an unauthenticated remote attacker to execute arbitrary code through specially crafted URLs by manipulating the PATH_INFO, leading to potential remote code execution. This template checks for the presence of the vulnerable misconfiguration without performing exploitation.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2019/CVE-2019-11043.yaml"}
{"ID":"CVE-2019-11248","Info":{"Name":"Debug Endpoint pprof - Exposure Detection","Severity":"high","Description":"The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2019/CVE-2019-11248.yaml"}
{"ID":"CVE-2019-11253","Info":{"Name":"Kubernetes API Server - YAML Parsing DoS (Billion Laughs)","Severity":"high","Description":"The Kubernetes API server is vulnerable to a denial of service attack via YAML/JSON parsing. An attacker can send a specially crafted YAML/JSON payload that causes exponential memory consumption (Billion Laughs attack), leading to API server crash.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2019/CVE-2019-11253.yaml"}
{"ID":"CVE-2019-11370","Info":{"Name":"Carel pCOWeb \u003cB1.2.4 - Cross-Site Scripting","Severity":"medium","Description":"Carel pCOWeb prior to B1.2.4 is vulnerable to stored cross-site scripting, as demonstrated by the config/pw_snmp.html \"System contact\" field.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2019/CVE-2019-11370.yaml"}
@@ -945,7 +950,9 @@
{"ID":"CVE-2020-10148","Info":{"Name":"SolarWinds Orion API - Auth Bypass","Severity":"critical","Description":"SolarWinds Orion API is vulnerable to an authentication bypass vulnerability that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance. SolarWinds Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1 are affected.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-10148.yaml"}
{"ID":"CVE-2020-10189","Info":{"Name":"ManageEngine Desktop Central Java Deserialization","Severity":"critical","Description":"Zoho ManageEngine Desktop Central before 10.0.474 is vulnerable to a deserialization of untrusted data, which permits remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-10189.yaml"}
{"ID":"CVE-2020-10204","Info":{"Name":"Sonatype Nexus Repository Manager 3 - Remote Code Execution","Severity":"high","Description":"Sonatype Nexus Repository Manager 3 up to and including 3.21.1 is vulnerable to Expression Language injection. An attacker authenticated with an administrative account can inject an EL expression into the user \"roles\" field of the coreui_User update endpoint, leading to remote code execution. This is a bypass of the fix for CVE-2018-16621.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2020/CVE-2020-10204.yaml"}
{"ID":"CVE-2020-10220","Info":{"Name":"rConfig 3.9 - SQL Injection","Severity":"critical","Description":"An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-10220.yaml"}
{"ID":"CVE-2020-10221","Info":{"Name":"rConfig \u003c= 3.9.4 - Authenticated OS Command Injection","Severity":"high","Description":"lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.9.4 does not properly sanitize the fileName POST parameter before using it in a shell command, allowing an authenticated attacker to inject arbitrary OS commands. This template uses default admin credentials to log in before triggering the injection; override the username / userpassword fields for environments with changed credentials.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2020/CVE-2020-10221.yaml"}
{"ID":"CVE-2020-10257","Info":{"Name":"ThemeREX Addons - Remote Code Execution","Severity":"critical","Description":"ThemeREX Addons plugin before 2020-03-09 for WordPress contains an access control vulnerability in the /trx_addons/v2/get/sc_layout REST API endpoint, allowing any users to execute PHP functions because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter, letting attackers execute arbitrary PHP functions, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-10257.yaml"}
{"ID":"CVE-2020-10532","Info":{"Name":"WatchGuard Fireware AD Helper Component - Credentials Disclosure","Severity":"critical","Description":"WatchGuard Fireware Threat Detection and Response (TDR) service contains a credential-disclosure vulnerability in the AD Helper component that allows unauthenticated attackers to gain Active Directory credentials for a Windows domain in plaintext.","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2020/CVE-2020-10532.yaml"}
{"ID":"CVE-2020-10546","Info":{"Name":"rConfig 3.9.4 - SQL Injection","Severity":"critical","Description":"rConfig 3.9.4 and previous versions have unauthenticated compliancepolicies.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-10546.yaml"}
@@ -976,7 +983,7 @@
{"ID":"CVE-2020-11975","Info":{"Name":"Apache Unomi - Remote Code Execution","Severity":"critical","Description":"Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process, enabling attackers to execute arbitrary code.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-11975.yaml"}
{"ID":"CVE-2020-11978","Info":{"Name":"Apache Airflow \u003c=1.10.10 - Remote Code Execution","Severity":"high","Description":"Apache Airflow versions 1.10.10 and below are vulnerable to remote code/command injection vulnerabilities in one of the example DAGs shipped with Airflow. This could allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use).","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2020/CVE-2020-11978.yaml"}
{"ID":"CVE-2020-11984","Info":{"Name":"Apache HTTP Server - Remote Code Execution","Severity":"critical","Description":"Apache HTTP Server 2.4.32 to 2.4.44 contains an info disclosure and possible remote code execution caused by a vulnerability in mod_proxy_uwsgi, letting remote attackers access sensitive information and potentially execute arbitrary code, exploit requires sending crafted requests.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-11984.yaml"}
{"ID":"CVE-2020-11991","Info":{"Name":"Apache Cocoon 2.1.12 - XML Injection","Severity":"high","Description":"Apache Cocoon 2.1.12 is susceptible to XML injection. When using the StreamGenerator, the code parses a user-provided XML. A specially crafted XML, including external system entities, can be used to access any file on the server system.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2020/CVE-2020-11991.yaml"}
{"ID":"CVE-2020-11991","Info":{"Name":"Apache Cocoon 2.1.12 - XML Injection","Severity":"high","Description":"Apache Cocoon 2.1.12 contains an XML injection caused by parsing user-provided XML with external system entities in StreamGenerator, letting attackers access arbitrary files on the server, exploit requires sending malicious XML.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2020/CVE-2020-11991.yaml"}
{"ID":"CVE-2020-12054","Info":{"Name":"WordPress Catch Breadcrumb \u003c1.5.4 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Catch Breadcrumb plugin before 1.5.4 contains a reflected cross-site scripting vulnerability via the s parameter (a search query). Also affected are 16 themes if the plugin is enabled: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean Enterprise and Clean Enterprise PRO, Bold Photography PRO, Intuitive PRO, Devotepress PRO, Clean Blocks PRO, Foodoholic PRO, Catch Mag PRO, Catch Wedding PRO, and Higher Education PRO.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-12054.yaml"}
{"ID":"CVE-2020-12116","Info":{"Name":"Zoho ManageEngine OpManger - Arbitrary File Read","Severity":"high","Description":"Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a specially crafted request.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2020/CVE-2020-12116.yaml"}
{"ID":"CVE-2020-12124","Info":{"Name":"WAVLINK WN530H4 live_api.cgi - Command Injection","Severity":"critical","Description":"A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arbitrary Linux commands as root without authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-12124.yaml"}
@@ -1141,6 +1148,7 @@
{"ID":"CVE-2020-28871","Info":{"Name":"Monitorr 1.7.6m - Unauthenticated Remote Code Execution","Severity":"critical","Description":"Monitorr 1.7.6m is susceptible to a remote code execution vulnerability. Improper input validation and lack of authorization leads to arbitrary file uploads in the web application. An unauthorized attacker with web access to could upload and execute a specially crafted file, leading to remote code execution within the Monitorr.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-28871.yaml"}
{"ID":"CVE-2020-28976","Info":{"Name":"WordPress Canto 1.3.0 - Blind Server-Side Request Forgery","Severity":"medium","Description":"WordPress Canto plugin 1.3.0 is susceptible to blind server-side request forgery. An attacker can make a request to any internal and external server via /includes/lib/detail.php?subdomain and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2020/CVE-2020-28976.yaml"}
{"ID":"CVE-2020-29047","Info":{"Name":"WP Hotel Booking \u003c 1.10.4 - PHP Object Injection","Severity":"critical","Description":"The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpress_hotel_booking_1 cookie in load in includes/class-wphb-sessions.php.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-29047.yaml"}
{"ID":"CVE-2020-29134","Info":{"Name":"TOTVS Fluig \u003c= 1.7.0 - Arbitrary File Read","Severity":"high","Description":"TOTVS Fluig platform contains a path traversal caused by base64-encoded manipulation of the 'file' parameter, letting attackers access arbitrary files, exploit requires attacker to control the 'file' parameter.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2020/CVE-2020-29134.yaml"}
{"ID":"CVE-2020-29164","Info":{"Name":"PacsOne Server \u003c7.1.1 - Cross-Site Scripting","Severity":"medium","Description":"PacsOne Server (PACS Server In One Box) below 7.1.1 is vulnerable to cross-site scripting.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2020/CVE-2020-29164.yaml"}
{"ID":"CVE-2020-29214","Info":{"Name":"Alumni Management System 1.0 - SQL Injection","Severity":"critical","Description":"SourceCodester Alumni Management System 1.0 contains a sql_injection caused by unsanitized input in admin/login.php, letting attackers bypass authentication, exploit requires injection of malicious SQL payload.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-29214.yaml"}
{"ID":"CVE-2020-29227","Info":{"Name":"Car Rental Management System 1.0 - Local File Inclusion","Severity":"critical","Description":"Car Rental Management System 1.0 allows an unauthenticated user to perform a file inclusion attack against the /index.php file with a partial filename in the \"page\" parameter, leading to code execution.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2020/CVE-2020-29227.yaml"}
@@ -1628,7 +1636,7 @@
{"ID":"CVE-2021-37573","Info":{"Name":"Tiny Java Web Server - Cross-Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting vulnerability in the web server TTiny Java Web Server and Servlet Container (TJWS) \u003c=1.115 allows an adversary to inject malicious code on the server's \"404 Page not Found\" error page.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-37573.yaml"}
{"ID":"CVE-2021-37580","Info":{"Name":"Apache ShenYu Admin JWT - Authentication Bypass","Severity":"critical","Description":"Apache ShenYu 2.3.0 and 2.4.0 allow Admin access without proper authentication. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-37580.yaml"}
{"ID":"CVE-2021-37589","Info":{"Name":"Virtua Software Cobranca \u003c12R - Blind SQL Injection","Severity":"high","Description":"Virtua Cobranca before 12R allows blind SQL injection on the login page.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-37589.yaml"}
{"ID":"CVE-2021-37598","Info":{"Name":"WP Cerber \u003c 8.9.3 - Broken Access Control","Severity":"medium","Description":"WP Cerber \u003c 8.9.3 contains a bypass of /wp-json access control caused by improper handling of trailing '?' character, letting unauthorized users access protected REST API endpoints, exploit requires sending a request with a trailing '?'.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2021/CVE-2021-37598.yaml"}
{"ID":"CVE-2021-37598","Info":{"Name":"WP Cerber \u003c 8.9.3 - Broken Access Control","Severity":"medium","Description":"WP Cerber \u003c 8.9.3 contains a bypass of /wp-json access control caused by improper handling of trailing '?' character, letting unauthorized users access protected REST API endpoints. The exploit requires sending a request with a trailing '?'.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2021/CVE-2021-37598.yaml"}
{"ID":"CVE-2021-37704","Info":{"Name":"phpfastcache - phpinfo Resource Exposure","Severity":"medium","Description":"phpinfo() is susceptible to resource exposure in unprotected composer vendor folders via phpfastcache/phpfastcache.","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2021/CVE-2021-37704.yaml"}
{"ID":"CVE-2021-37833","Info":{"Name":"Hotel Druid 3.0.2 - Cross-Site Scripting","Severity":"medium","Description":"Hotel Druid 3.0.2 contains a cross-site scripting vulnerability in multiple pages which allows for arbitrary execution of JavaScript commands.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-37833.yaml"}
{"ID":"CVE-2021-38146","Info":{"Name":"Wipro Holmes Orchestrator 20.4.1 - Arbitrary File Download","Severity":"high","Description":"The File Download API in Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read arbitrary files via absolute path traversal in the SearchString JSON field in /home/download POST data.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-38146.yaml"}
@@ -1716,6 +1724,7 @@
{"ID":"CVE-2021-42237","Info":{"Name":"Sitecore Experience Platform Pre-Auth RCE","Severity":"critical","Description":"Sitecore XP 7.5 to Sitecore XP 8.2 Update 7 is vulnerable to an insecure deserialization attack where remote commands can be executed by an attacker with no authentication or special configuration required.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-42237.yaml"}
{"ID":"CVE-2021-42258","Info":{"Name":"BillQuick Web Suite SQL Injection","Severity":"critical","Description":"BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-42258.yaml"}
{"ID":"CVE-2021-42359","Info":{"Name":"WP DSGVO Tools (GDPR) \u003c= 3.1.23 - Unauthenticated Arbitrary Post Deletion","Severity":"high","Description":"WP DSGVO Tools (GDPR) \u003c= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanently delete an arbitrary post or page on the site by sending an AJAX request with the “action” parameter set to “admin-dismiss-unsubscribe” and the “id” parameter set to the post to be deleted. Sending such a request would move the post to the trash, and repeating the request would permanently delete the post in question.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-42359.yaml"}
{"ID":"CVE-2021-42392","Info":{"Name":"H2 Database Console - JNDI Injection RCE","Severity":"critical","Description":"The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution via the H2 web console (versions before 2.0.206 / 1.4.198 with the console enabled).\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-42392.yaml"}
{"ID":"CVE-2021-42551","Info":{"Name":"NetBiblio WebOPAC - Cross-Site Scripting","Severity":"medium","Description":"NetBiblio WebOPAC before 4.0.0.320 is affected by a reflected cross-site scripting vulnerability in its Wikipedia module through /NetBiblio/search/shortview via the searchTerm parameter.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-42551.yaml"}
{"ID":"CVE-2021-42565","Info":{"Name":"myfactory FMS - Cross-Site Scripting","Severity":"medium","Description":"myfactory.FMS before 7.1-912 allows cross-site scripting via the UID parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-42565.yaml"}
{"ID":"CVE-2021-42566","Info":{"Name":"myfactory FMS - Cross-Site Scripting","Severity":"medium","Description":"myfactory.FMS before 7.1-912 allows cross-site scripting via the Error parameter.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-42566.yaml"}
@@ -1751,7 +1760,7 @@
{"ID":"CVE-2021-4448","Info":{"Name":"Kaswara Modern VC Addons \u003c= 3.0.1 - Missing Authorization","Severity":"high","Description":"The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insufficient capability checking on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of unauthorized actions such as importing data, uploading arbitrary files, deleting arbitrary files, and more.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2021/CVE-2021-4448.yaml"}
{"ID":"CVE-2021-4449","Info":{"Name":"ZoomSounds Plugin - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"ZoomSounds plugin for WordPress contains a file upload vulnerability in savepng.php\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-4449.yaml"}
{"ID":"CVE-2021-44515","Info":{"Name":"Zoho ManageEngine Desktop Central - Remote Code Execution","Severity":"critical","Description":"Zoho ManageEngine Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-44515.yaml"}
{"ID":"CVE-2021-44528","Info":{"Name":"Open Redirect in Host Authorization Middleware","Severity":"medium","Description":"Specially crafted \"X-Forwarded-Host\" headers in combination with certain \"allowed host\" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-44528.yaml"}
{"ID":"CVE-2021-44528","Info":{"Name":"Open Redirect in Host Authorization Middleware","Severity":"medium","Description":"Specially crafted X-Forwarded-Host headers in combination with certain allowed host formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2021/CVE-2021-44528.yaml"}
{"ID":"CVE-2021-44529","Info":{"Name":"Ivanti EPM Cloud Services Appliance Code Injection","Severity":"critical","Description":"Ivanti EPM Cloud Services Appliance (CSA) before version 4.6.0-512 is susceptible to a code injection vulnerability because it allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-44529.yaml"}
{"ID":"CVE-2021-4462","Info":{"Name":"Employee Records System 1.0 - Unauthenticated File Upload RCE","Severity":"critical","Description":"Employee Records System version 1.0 contains an unrestricted file upload vulnerability in uploadID.php that allows remote unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2021/CVE-2021-4462.yaml"}
{"ID":"CVE-2021-4463","Info":{"Name":"Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download","Severity":"high","Description":"Longjing Technology BEMS API 1.21 is vulnerable to local file inclusion. Input passed through the fileName parameter through the downloads API endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks.","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2021/CVE-2021-4463.yaml"}
@@ -1898,6 +1907,7 @@
{"ID":"CVE-2022-1168","Info":{"Name":"WordPress WP JobSearch \u003c1.5.1 - Cross-Site Scripting","Severity":"medium","Description":"WordPress WP JobSearch plugin prior to 1.5.1 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-1168.yaml"}
{"ID":"CVE-2022-1170","Info":{"Name":"JobMonster \u003c 4.5.2.9 - Cross-Site Scripting","Severity":"medium","Description":"In the theme JobMonster \u003c 4.5.2.9 there is a XSS vulnerability as the input for the search form is provided through unsanitized GET requests.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-1170.yaml"}
{"ID":"CVE-2022-1221","Info":{"Name":"WordPress Gwyn's Imagemap Selector \u003c=0.3.3 - Cross-Site Scripting","Severity":"medium","Description":"Wordpress Gwyn's Imagemap Selector plugin 0.3.3 and prior contains a reflected cross-site scripting vulnerability. It does not sanitize the id and class parameters before returning them back in attributes.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-1221.yaml"}
{"ID":"CVE-2022-1281","Info":{"Name":"Photo Gallery WordPress v1.6.3 - SQL Injection","Severity":"critical","Description":"Photo Gallery WordPress plugin v1.6.3 contains a SQL injection caused by improper escaping of $_POST['filter_tag'] parameter in SQL queries, letting attackers execute arbitrary SQL commands, exploit requires sending crafted POST requests.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-1281.yaml"}
{"ID":"CVE-2022-1329","Info":{"Name":"Elementor Website Builder - Remote Code Execution","Severity":"high","Description":"The Elementor Website Builder plugin for WordPress versions 3.6.0 to 3.6.2 are vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file. This makes it possible for attackers to modify site data and upload malicious files which can be used to obtain remote code execution.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2022/CVE-2022-1329.yaml"}
{"ID":"CVE-2022-1386","Info":{"Name":"WordPress Fusion Builder \u003c3.6.2 - Server-Side Request Forgery","Severity":"critical","Description":"WordPress Fusion Builder plugin before 3.6.2 is susceptible to server-side request forgery. The plugin does not validate a parameter in its forms, which can be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. An attacker can potentially interact with hosts on the server's local network, bypass firewalls, and access control measures.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-1386.yaml"}
{"ID":"CVE-2022-1388","Info":{"Name":"F5 BIG-IP iControl - REST Auth Bypass RCE","Severity":"critical","Description":"F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, may allow undisclosed requests to bypass iControl REST authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-1388.yaml"}
@@ -2052,6 +2062,7 @@
{"ID":"CVE-2022-27593","Info":{"Name":"QNAP QTS Photo Station External Reference - Local File Inclusion","Severity":"critical","Description":"QNAP QTS Photo Station External Reference is vulnerable to local file inclusion via an externally controlled reference to a resource vulnerability. If exploited, this could allow an attacker to modify system files. The vulnerability is fixed in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2022/CVE-2022-27593.yaml"}
{"ID":"CVE-2022-27849","Info":{"Name":"WordPress Simple Ajax Chat \u003c20220116 - Sensitive Information Disclosure vulnerability","Severity":"high","Description":"WordPress Simple Ajax Chat before 20220216 is vulnerable to sensitive information disclosure. The plugin does not properly restrict access to the exported data via the sac-export.csv file, which could allow unauthenticated users to access it.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2022/CVE-2022-27849.yaml"}
{"ID":"CVE-2022-27924","Info":{"Name":"Zimbra Collaboration Suite - Memcached Command Injection","Severity":"high","Description":"Zimbra Collaboration Suite versions 8.8.15 and 9.0 contain a memcached command injection vulnerability that allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance, leading to cache poisoning and potential credential theft.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-27924.yaml"}
{"ID":"CVE-2022-27925","Info":{"Name":"Zimbra Collaboration Suite 8.8.15/9.0 - Zip Path Traversal","Severity":"high","Description":"Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2022/CVE-2022-27925.yaml"}
{"ID":"CVE-2022-27926","Info":{"Name":"Zimbra Collaboration (ZCS) - Cross Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-27926.yaml"}
{"ID":"CVE-2022-27927","Info":{"Name":"Microfinance Management System 1.0 - SQL Injection","Severity":"critical","Description":"Microfinance Management System 1.0 is susceptible to SQL Injection.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-27927.yaml"}
{"ID":"CVE-2022-27984","Info":{"Name":"Cuppa CMS v1.0 - SQL injection","Severity":"critical","Description":"CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via the menu_filter parameter at /administrator/templates/default/html/windows/right.php.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-27984.yaml"}
@@ -2060,6 +2071,7 @@
{"ID":"CVE-2022-28033","Info":{"Name":"Atom.CMS 2.0 - SQL Injection","Severity":"critical","Description":"Atom.CMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_uploads.php which allows an attacker to execute arbitrary SQL commands.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-28033.yaml"}
{"ID":"CVE-2022-28079","Info":{"Name":"College Management System 1.0 - SQL Injection","Severity":"high","Description":"College Management System 1.0 contains a SQL injection vulnerability via the course code parameter.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2022/CVE-2022-28079.yaml"}
{"ID":"CVE-2022-28080","Info":{"Name":"Royal Event - SQL Injection","Severity":"high","Description":"Royal Event is vulnerable to a SQL injection vulnerability.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2022/CVE-2022-28080.yaml"}
{"ID":"CVE-2022-28108","Info":{"Name":"Selenium Grid \u003c 4.0.0-alpha-7 - Remote Code Execution","Severity":"critical","Description":"Selenium Server (Grid) before 4.0.0-alpha-7 permits unauthenticated session creation and unsafe capability injection via /wd/hub/session due to missing Origin validation and weak content-type enforcement.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-28108.yaml"}
{"ID":"CVE-2022-28117","Info":{"Name":"Navigate CMS 2.9.4 - Server-Side Request Forgery","Severity":"medium","Description":"Navigate CMS 2.9.4 is susceptible to server-side request forgery via feed_parser class. This can allow a remote attacker to force the application to make arbitrary requests via injection of arbitrary URLs into the feed parameter, thus enabling possible theft of sensitive information, data modification, and/or unauthorized operation execution.\n","Classification":{"CVSSScore":"4.9"}},"file_path":"http/cves/2022/CVE-2022-28117.yaml"}
{"ID":"CVE-2022-28219","Info":{"Name":"Zoho ManageEngine ADAudit Plus \u003c7600 - XML Entity Injection/Remote Code Execution","Severity":"critical","Description":"Zoho ManageEngine ADAudit Plus before version 7060 is vulnerable to an\nunauthenticated XML entity injection attack that can lead to remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-28219.yaml"}
{"ID":"CVE-2022-28290","Info":{"Name":"WordPress Country Selector \u003c1.6.6 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Country Selector plugin prior to 1.6.6 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape the country and lang parameters before outputting them back in the response. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-28290.yaml"}
@@ -2226,6 +2238,7 @@
{"ID":"CVE-2022-39048","Info":{"Name":"ServiceNow - Cross-site Scripting","Severity":"medium","Description":"A XSS vulnerability was identified in the ServiceNow UI page assessment_redirect. To exploit this vulnerability, an attacker would need to persuade an authenticated user to click a maliciously crafted URL. Successful exploitation potentially could be used to conduct various client-side attacks, including, but not limited to, phishing, redirection, theft of CSRF tokens, and use of an authenticated user's browser or session to attack other systems.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-39048.yaml"}
{"ID":"CVE-2022-3908","Info":{"Name":"WordPress Helloprint \u003c1.4.7 - Cross-Site Scripting","Severity":"medium","Description":"WordPress Helloprint plugin before 1.4.7 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-3908.yaml"}
{"ID":"CVE-2022-39195","Info":{"Name":"LISTSERV 17 - Cross-Site Scripting","Severity":"medium","Description":"LISTSERV 17 web interface contains a cross-site scripting vulnerability. An attacker can inject arbitrary JavaScript or HTML via the \"c\" parameter, thereby possibly allowing the attacker to steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-39195.yaml"}
{"ID":"CVE-2022-39258","Info":{"Name":"Mailcow Dockerized Swagger UI - Cross-Site Scripting","Severity":"medium","Description":"Mailcow-dockerized before 2022-09a uses a vulnerable version of Swagger UI (before 4.11.1) that is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. When a user accesses the Swagger documentation with a crafted configUrl or url parameter containing JavaScript payloads, arbitrary code execution can occur in the user's browser. This allows attackers to steal cookies, session data, or execute actions on behalf of the victim by enticing them to open a malicious Swagger UI link.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2022/CVE-2022-39258.yaml"}
{"ID":"CVE-2022-3933","Info":{"Name":"WordPress Essential Real Estate \u003c3.9.6 - Authenticated Cross-Site Scripting","Severity":"medium","Description":"WordPress Essential Real Estate plugin before 3.9.6 contains an authenticated cross-site scripting vulnerability. The plugin does not sanitize and escape some parameters, which can allow someone with a role as low as admin to inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow theft of cookie-based authentication credentials and launch of other attacks.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-3933.yaml"}
{"ID":"CVE-2022-3934","Info":{"Name":"WordPress FlatPM \u003c3.0.13 - Cross-Site Scripting","Severity":"medium","Description":"WordPress FlatPM plugin before 3.0.13 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape certain parameters before outputting them back in pages, which can be exploited against high privilege users such as admin. An attacker can steal cookie-based authentication credentials and launch other attacks.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2022/CVE-2022-3934.yaml"}
{"ID":"CVE-2022-3980","Info":{"Name":"Sophos Mobile managed on-premises - XML External Entity Injection","Severity":"critical","Description":"An XML External Entity (XXE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2022/CVE-2022-3980.yaml"}
@@ -2465,6 +2478,7 @@
{"ID":"CVE-2023-25346","Info":{"Name":"ChurchCRM 4.5.3 - Cross-Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of /churchcrm/v2/family/not-found.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-25346.yaml"}
{"ID":"CVE-2023-25573","Info":{"Name":"Metersphere - Arbitrary File Read","Severity":"high","Description":"Metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in `/api/jmeter/download/files`, which allows any user to download any file without authentication. This issue may expose all files available to the running process. This issue has been addressed in version 1.20.20 lts and 2.7.1\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-25573.yaml"}
{"ID":"CVE-2023-25717","Info":{"Name":"Ruckus Wireless Admin - Remote Code Execution","Severity":"critical","Description":"Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-25717.yaml"}
{"ID":"CVE-2023-25826","Info":{"Name":"OpenTSDB \u003c= 2.4.1 - Unauthenticated RCE via Gnuplot Injection","Severity":"critical","Description":"OpenTSDB contains a command injection caused by insufficient validation of parameters passed to the legacy HTTP query API, letting attackers inject crafted OS commands and execute malicious code, exploit requires sending crafted parameters.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-25826.yaml"}
{"ID":"CVE-2023-26035","Info":{"Name":"ZoneMinder Snapshots - Command Injection","Severity":"critical","Description":"ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. There are no permissions check on the snapshot action, which expects an id to fetch an existing monitor but can be passed an object to create a new one instead. TriggerOn ends up calling shell_exec using the supplied Id.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-26035.yaml"}
{"ID":"CVE-2023-26067","Info":{"Name":"Lexmark Printers - Command Injection","Severity":"high","Description":"Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4).\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2023/CVE-2023-26067.yaml"}
{"ID":"CVE-2023-2624","Info":{"Name":"KiviCare WordPress Plugin - Cross-Site Scripting","Severity":"medium","Description":"The KiviCare WordPress plugin before 3.2.1 does not sanitise and escape the 'filterType' parameter, leading to Reflected Cross-Site Scripting.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-2624.yaml"}
@@ -2556,6 +2570,7 @@
{"ID":"CVE-2023-31478","Info":{"Name":"GL.iNET SSID Key Disclosure","Severity":"high","Description":"An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2023/CVE-2023-31478.yaml"}
{"ID":"CVE-2023-31548","Info":{"Name":"ChurchCRM v4.5.3 - Cross-Site Scripting","Severity":"medium","Description":"A stored Cross-site scripting (XSS) vulnerability in the FundRaiserEditor.php component of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2023/CVE-2023-31548.yaml"}
{"ID":"CVE-2023-3169","Info":{"Name":"tagDiv Composer \u003c 4.2 - Stored Cross-Site Scripting","Severity":"high","Description":"tagDiv Composer plugin versions before 4.2 for WordPress are vulnerable to unauthenticated stored XSS via the /wp-json/tdw/save_css endpoint. An attacker can inject malicious JavaScript code through the compiled_css parameter, which gets stored and executed when the CSS is loaded.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-3169.yaml"}
{"ID":"CVE-2023-31719","Info":{"Name":"FUXA \u003c= 1.1.12 - Unauthenticated SQL Injection","Severity":"critical","Description":"FUXA \u003c= 1.1.12 contains a SQL injection caused by unsanitized input in /api/signin, letting attackers execute arbitrary SQL commands, exploit requires sending crafted input to the endpoint.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-31719.yaml"}
{"ID":"CVE-2023-3188","Info":{"Name":"Owncast - Server Side Request Forgery","Severity":"medium","Description":"Server-Side Request Forgery (SSRF) in GitHub repository owncast/owncast prior to 0.1.0.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2023/CVE-2023-3188.yaml"}
{"ID":"CVE-2023-3197","Info":{"Name":"WordPress MStore API \u003c= 4.0.1 - Unauthenticated SQL Injection","Severity":"critical","Description":"MStore API plugin for WordPress up to version 4.0.1 contains an unauthenticated blind SQL injection caused by insufficient escaping of 'id' parameter in SQL queries, letting attackers execute arbitrary SQL commands without authentication, exploit requires sending crafted requests with malicious 'id' parameter.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2023/CVE-2023-3197.yaml"}
{"ID":"CVE-2023-32068","Info":{"Name":"XWiki - Open Redirect","Severity":"medium","Description":"XWiki Platform is vulnerable to open redirect attacks due to improper validation of the xredirect parameter. This allows an attacker to redirect users to an arbitrary website. The vulnerability is patched in versions 14.10.4 and 15.0.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-32068.yaml"}
@@ -2845,6 +2860,8 @@
{"ID":"CVE-2023-5244","Info":{"Name":"Microweber \u003c V.2.0 - Cross-Site Scripting","Severity":"medium","Description":"Reflected Cross-Site Scripting Vulnerability in types GET parameter on the /editor_tools/rte_image_editor endpoint.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-5244.yaml"}
{"ID":"CVE-2023-5360","Info":{"Name":"WordPress Royal Elementor Addons Plugin \u003c= 1.3.78 - Arbitrary File Upload","Severity":"critical","Description":"Arbitrary File Upload vulnerability in WordPress Royal Elementor Addons Plugin. This could allow a malicious actor to upload any type of file to your website. This can include backdoors which are then executed to gain further access to your website. This vulnerability has been fixed in version 1.3.79\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-5360.yaml"}
{"ID":"CVE-2023-5375","Info":{"Name":"Mosparo \u003c 1.0.2 - Open Redirect","Severity":"medium","Description":"Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-5375.yaml"}
{"ID":"CVE-2023-54335","Info":{"Name":"eXtplorer \u003c= 2.1.14 - Authentication Bypass","Severity":"critical","Description":"eXtplorer \u003c= 2.1.14 contains an authentication bypass in ext_find_user() (include/users.php). When the `password` POST field is omitted entirely, the password is NULL and the function returns the matching user record without checking any password. With the default \"admin\" account, an unauthenticated attacker can log in as administrator.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2023/CVE-2023-54335.yaml"}
{"ID":"CVE-2023-54391","Info":{"Name":"Proxmox VE - Default Credentials with TFA Bypass","Severity":"critical","Description":"Detected Proxmox VE was accessible using default root@pam credentials combined with a TFA challenge bypass. An attacker could authenticate as root by submitting the default password \"root@pam\" along with a crafted tfa-challenge parameter, thereby bypassing two-factor authentication enforcement and gaining full administrative access to the hypervisor management interface.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2023/CVE-2023-54391.yaml"}
{"ID":"CVE-2023-5556","Info":{"Name":"Structurizr on-premises - Cross Site Scripting","Severity":"medium","Description":"Cross-site Scripting (XSS) - Reflected in GitHub repository structurizr/onpremises prior to 3194.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-5556.yaml"}
{"ID":"CVE-2023-5558","Info":{"Name":"LearnPress \u003c 4.2.5.5 - Cross-Site Scripting","Severity":"medium","Description":"The LearnPress WordPress plugin before 4.2.5.5 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2023/CVE-2023-5558.yaml"}
{"ID":"CVE-2023-5559","Info":{"Name":"10Web Booster \u003c 2.24.18 - Unauthenticated Arbitrary Option Deletion","Severity":"critical","Description":"The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to delete arbitrary options from the database, leading to denial of service.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2023/CVE-2023-5559.yaml"}
@@ -3022,6 +3039,7 @@
{"ID":"CVE-2024-1512","Info":{"Name":"MasterStudy LMS WordPress Plugin \u003c= 3.2.5 - SQL Injection","Severity":"critical","Description":"The MasterStudy LMS WordPress Plugin for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-1512.yaml"}
{"ID":"CVE-2024-1561","Info":{"Name":"Gradio 4.3-4.12 - Local File Read","Severity":"high","Description":"Local file read by calling arbitrary methods of Components class between Gradio versions 4.3-4.12\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-1561.yaml"}
{"ID":"CVE-2024-1698","Info":{"Name":"NotificationX \u003c= 2.8.2 - SQL Injection","Severity":"critical","Description":"The NotificationX - Best FOMO, Social Proof, WooCommerce Sales Popup \u0026 Notification Bar Plugin With Elementor plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 2.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-1698.yaml"}
{"ID":"CVE-2024-1708","Info":{"Name":"ConnectWise ScreenConnect \u003c= 23.9.7 - Path Traversal","Severity":"high","Description":"ConnectWise ScreenConnect 23.9.7 and prior contain a path traversal caused by improper handling of user input, letting attackers execute remote code or access confidential data, exploit requires network access.\n","Classification":{"CVSSScore":"8.4"}},"file_path":"http/cves/2024/CVE-2024-1708.yaml"}
{"ID":"CVE-2024-1709","Info":{"Name":"ConnectWise ScreenConnect 23.9.7 - Authentication Bypass","Severity":"critical","Description":"ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-1709.yaml"}
{"ID":"CVE-2024-1728","Info":{"Name":"Gradio \u003e 4.19.1 UploadButton - Path Traversal","Severity":"high","Description":"gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-1728.yaml"}
{"ID":"CVE-2024-1751","Info":{"Name":"Tutor LMS \u003c= 2.1.10 - SQL Injection","Severity":"high","Description":"Tutor LMS – eLearning and online course solution plugin for WordPress [all versions up to 2.6.1] contains a time-based SQL Injection caused by insufficient escaping on the question_id parameter in SQL queries, letting authenticated attackers with subscriber or higher access extract sensitive information, exploit requires attacker to be authenticated with subscriber or higher privileges.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-1751.yaml"}
@@ -3387,6 +3405,7 @@
{"ID":"CVE-2024-56325","Info":{"Name":"Apache Pinot \u003c 1.3.0 - Authentication Bypass","Severity":"critical","Description":"This vulnerability allows remote attackers to bypass authentication on affected installations of Apache Pinot. Authentication is not required to exploit this vulnerability.The specific flaw exists within the AuthenticationFilter class. The issue results from insufficient neutralization of special characters in a URI. An attacker can leverage this vulnerability to bypass authentication on the system.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-56325.yaml"}
{"ID":"CVE-2024-56511","Info":{"Name":"DataEase \u003c 2.10.4 - Authentication Bypass via Whitelist Path Traversal","Severity":"critical","Description":"DataEase versions up to and including 2.10.3 contain an authentication bypass in `io.dataease.auth.filter.TokenFilter`. The filter passes the raw, unnormalized request URI to `WhitelistUtils.match()`, which only checks for whitelisted prefixes such as `/geo/`, `/customGeo/`, `/map/`, `/oauth2/`, and `/websocket` without resolving `..` segments. By prepending a whitelisted prefix and traversing back into the configured `server.servlet.context-path`, an attacker bypasses the filter while Tomcat still routes the request to the genuine, protected controller. This collapses the entire `/de2api` surface (user management, datasources, dashboards, exports) into unauthenticated access.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-56511.yaml"}
{"ID":"CVE-2024-56512","Info":{"Name":"Apache NiFi - Information Disclosure","Severity":"medium","Description":"Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to a Parameter Context, but in cases where the Process Group did not reference any Parameter values, the framework did not check user authorization for the bound Parameter Context. Missing authorization for a bound Parameter Context enabled clients to download non-sensitive Parameter values after creating the Process Group.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-56512.yaml"}
{"ID":"CVE-2024-56829","Info":{"Name":"Huang Yaoshi Pharmaceutical Management Software - Unrestricted File Upload","Severity":"critical","Description":"Huang Yaoshi Pharmaceutical Management Software up to 16.0 contains an unrestricted file upload caused by accepting .asp filenames in the UploadFile element of a SOAP request to /XSDService.asmx, letting attackers upload arbitrary files, exploit requires sending a crafted SOAP request.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2024/CVE-2024-56829.yaml"}
{"ID":"CVE-2024-57045","Info":{"Name":"D-Link DIR-859 - Information Disclosure","Severity":"critical","Description":"A critical information disclosure vulnerability exists in D-Link devices where sensitive device account information including credentials can be retrieved by sending an unauthenticated request to `/getcfg.php` endpoint with the parameter `SERVICES=DEVICE.ACCOUNT`. This could allow attackers to obtain administrative credentials and gain full control of the affected device.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-57045.yaml"}
{"ID":"CVE-2024-57046","Info":{"Name":"Netgear DGN2200 - Improper Authentication","Severity":"high","Description":"A vulnerability in the Netgear DGN2200 router with firmware version v1.0.0.46 and earlier permits unauthorized individuals to bypass the authentication. When adding \"?x=1.gif\" to the requested url, it will be recognized as passing the authentication.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2024/CVE-2024-57046.yaml"}
{"ID":"CVE-2024-57049","Info":{"Name":"TP-Link Archer C20 - Authentication Bypass","Severity":"critical","Description":"A vulnerability in the TP-Link Archer C20 router with firmware version V6.6_230412 and earlier permits unauthorized individuals to bypass authentication on interfaces under the /cgi directory. When adding a Referer header with value \"http://tplinkwifi.net\" to requests, the router will recognize the request as passing authentication, allowing access to protected administration interfaces.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-57049.yaml"}
@@ -3395,6 +3414,7 @@
{"ID":"CVE-2024-5765","Info":{"Name":"WpStickyBar \u003c= 2.1.0 - SQL Injection","Severity":"high","Description":"The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2024/CVE-2024-5765.yaml"}
{"ID":"CVE-2024-57726","Info":{"Name":"SimpleHelp \u003c= 5.5.7 - Privilege Escalation","Severity":"critical","Description":"SimpleHelp remote support software v5.5.7 and before contains a privilege escalation caused by insufficient access controls in API key creation, letting low-privileges technicians escalate privileges to server admin, exploit requires low-privileges technician access.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2024/CVE-2024-57726.yaml"}
{"ID":"CVE-2024-57727","Info":{"Name":"SimpleHelp \u003c= 5.5.7 - Unauthenticated Path Traversal","Severity":"high","Description":"SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2024/CVE-2024-57727.yaml"}
{"ID":"CVE-2024-57728","Info":{"Name":"SimpleHelp \u003c= 5.5.7 - Arbitrary File Upload","Severity":"high","Description":"SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user. This template is a version-based check: it reads the version banner exposed by the vendor's own /allversions page and flags branches that predate the January 2025 fixes.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2024/CVE-2024-57728.yaml"}
{"ID":"CVE-2024-58136","Info":{"Name":"Yii2 PHP Framework \u003c 2.0.52 - Remote Code Execution","Severity":"critical","Description":"Yii2 PHP Framework before 2.0.52 is vulnerable to remote code execution via improper validation of the __class key in JSON behaviors. An attacker can instantiate arbitrary PHP classes and achieve RCE.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-58136.yaml"}
{"ID":"CVE-2024-5827","Info":{"Name":"Vanna - SQL injection","Severity":"critical","Description":"Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents `\u003c?php system($_GET[0]); ?\u003e`. This can lead to command execution or the creation of backdoors.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2024/CVE-2024-5827.yaml"}
{"ID":"CVE-2024-5910","Info":{"Name":"Palo Alto Expedition - Admin Account Takeover","Severity":"critical","Description":"Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2024/CVE-2024-5910.yaml"}
@@ -3530,6 +3550,7 @@
{"ID":"CVE-2025-11307","Info":{"Name":"WP Google Maps \u003c 9.0.48 - Cross-Site Scripting","Severity":"high","Description":"WP Google Maps WordPress plugin \u003c 9.0.48 contains a stored XSS vulnerability caused by unsanitized user input in AJAX actions, letting unauthenticated attackers execute scripts via stored payloads.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-11307.yaml"}
{"ID":"CVE-2025-11368","Info":{"Name":"LearnPress \u003c 4.3.0 - Arbitrary Callback Execution to Information Exposure","Severity":"medium","Description":"The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. This is due to missing capability checks in the REST endpoint /wp-json/lp/v1/load_content_via_ajax which allows arbitrary callback execution of admin-only template methods. This makes it possible for unauthenticated attackers to retrieve admin curriculum HTML, quiz questions with correct answers, course materials, and other sensitive educational content via the REST API endpoint granted they can supply valid numeric IDs.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-11368.yaml"}
{"ID":"CVE-2025-11371","Info":{"Name":"Gladinet CentreStack \u0026 TrioFox - Local File Inclusion","Severity":"medium","Description":"In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and Triofox: All versions prior to and including 16.7.10368.56560\n","Classification":{"CVSSScore":"6.2"}},"file_path":"http/cves/2025/CVE-2025-11371.yaml"}
{"ID":"CVE-2025-11452","Info":{"Name":"Asgaros Forum \u003c 3.2.0 - SQL Injection","Severity":"high","Description":"Asgaros Forum for WordPress versions prior to 3.2.0 is vulnerable to unauthenticated SQL injection through the asgarosforum_unread_exclude cookie. The cookie is JSON-decoded and its object keys are imploded into a NOT IN() clause without sanitisation. The vulnerable query only runs while rendering the forum page, so the payload must be sent there rather than to the site root.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-11452.yaml"}
{"ID":"CVE-2025-11580","Info":{"Name":"PowerJob List - Authorization Bypass","Severity":"medium","Description":"PowerJob = 5.1.2 contains a broken access control caused by missing authorization in /user/list function, letting remote attackers access unauthorized resources, exploit requires no special privileges.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-11580.yaml"}
{"ID":"CVE-2025-11693","Info":{"Name":"Export WP Page to Static HTML \u003c= 4.3.4 - Cookie Exposure","Severity":"critical","Description":"Export WP Page to Static HTML \u0026 PDF WordPress plugin \u003c= 4.3.4 contains a sensitive information exposure caused by publicly exposed cookies.txt files with authentication cookies, letting unauthenticated attackers access sensitive authentication data, exploit requires site administrator to trigger backup with specific user role.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-11693.yaml"}
{"ID":"CVE-2025-11700","Info":{"Name":"N-central - XML External Entities Injection","Severity":"high","Description":"N-central versions \u003c 2025.4 are vulnerable to an XML External Entities injection leading to information disclosure.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-11700.yaml"}
@@ -3561,6 +3582,7 @@
{"ID":"CVE-2025-13801","Info":{"Name":"Yoco Payments \u003c= 3.8.8 - Path Traversal","Severity":"high","Description":"Yoco Payments WordPress plugin \u003c= 3.8.8 contains a path traversal caused by improper validation of the file parameter, letting unauthenticated attackers read arbitrary files on the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-13801.yaml"}
{"ID":"CVE-2025-13920","Info":{"Name":"WP Directory Kit \u003c 1.5.0 - Unauthenticated Email Exposure","Severity":"medium","Description":"WP Directory Kit plugin for WordPress \u003c= 1.4.9 contains a sensitive information exposure caused by improper access control in wdk_public_action AJAX handler, letting unauthenticated attackers extract email addresses of users with Directory Kit-specific roles.\n","Classification":{"CVSSScore":"6.2"}},"file_path":"http/cves/2025/CVE-2025-13920.yaml"}
{"ID":"CVE-2025-13956","Info":{"Name":"LearnPress \u003c 4.3.2 - Broken Access Control","Severity":"medium","Description":"The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the statistic function in all versions up to, and including, 4.3.1. This makes it possible for unauthenticated attackers to view the plugin's orders statistics, including total revenue summaries and order status counts.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-13956.yaml"}
{"ID":"CVE-2025-14047","Info":{"Name":"User Frontend \u003c= 4.2.4 - Missing Authorization to Unauthenticated Attachment Deletion","Severity":"medium","Description":"The WP User Frontend plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check in the Frontend_Form_Ajax::submit_post function.\nThis makes it possible for unauthenticated attackers to delete attachment records through the plugin's AJAX handling when a public frontend form is available.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-14047.yaml"}
{"ID":"CVE-2025-14124","Info":{"Name":"Team WordPress Plugin (TLP Team) \u003c= 5.0.9 - SQL Injection","Severity":"high","Description":"Team WordPress plugin \u003c= 5.0.11 contains a SQL injection caused by improper sanitization and escaping of a parameter in an AJAX action accessible to unauthenticated users, letting remote attackers execute arbitrary SQL commands.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-14124.yaml"}
{"ID":"CVE-2025-14155","Info":{"Name":"Premium Addons for Elementor - Unauthenticated Information Disclosure","Severity":"medium","Description":"Premium Addons for Elementor plugin for WordPress version 4.11.53 and below contains an unauthenticated information disclosure vulnerability.The vulnerability exists due to a missing authorization check in the get_template_content() AJAX handler, allowing unauthenticated attackers to retrieve private, draft, and pending Elementor templates that may contain sensitive information such as API keys, credentials, customer data,or unpublished content.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-14155.yaml"}
{"ID":"CVE-2025-14340","Info":{"Name":"Payara Server - Cross-Site Scripting","Severity":"high","Description":"Payara Server versions \u003c4.1.2.191.54, \u003c5.83.0, \u003c6.34.0, and \u003c7.2026.1 contain a stored XSS vulnerability caused by improper input sanitization in the REST Management Interface. This allows attackers to mislead administrators into changing the admin password via a URL payload; however, the exploit requires administrator interaction.\n","Classification":{"CVSSScore":"9.0"}},"file_path":"http/cves/2025/CVE-2025-14340.yaml"}
@@ -3568,6 +3590,8 @@
{"ID":"CVE-2025-14528","Info":{"Name":"D-Link DIR-803 - Authentication Bypass","Severity":"high","Description":"An authentication bypass vulnerability exists in D-Link DIR-803 routers (firmware A1 1.04 and earlier). By manipulating the AUTHORIZED_GROUP parameter in /getcfg.php via newline injection, an attacker can retrieve XML configuration containing administrator credentials without authentication.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-14528.yaml"}
{"ID":"CVE-2025-14611","Info":{"Name":"Gladinet CentreStack \u0026 Triofox - Hardcoded Credentials","Severity":"critical","Description":"Gladinet CentreStack and Triofox \u003c 16.12.10420.56791 contain a hardcoded credentials vulnerability caused by use of hardcoded AES cryptoscheme values, letting attackers perform arbitrary local file inclusion without authentication, potentially leading to full system compromise.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-14611.yaml"}
{"ID":"CVE-2025-14726","Info":{"Name":"WordPress Widgets for Social Photo Feed \u003c= 1.8 - Information Disclosure","Severity":"medium","Description":"Widgets for Social Photo Feed WordPress plugin \u003c= 1.8 contains a broken access control caused by missing capability checks on specific REST API endpoints, letting unauthenticated attackers access and modify plugin settings remotely.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-14726.yaml"}
{"ID":"CVE-2025-14998","Info":{"Name":"Branda WordPress plugin - Privilege Escalation","Severity":"critical","Description":"Branda WordPress plugin \u003c= 3.4.24 contains a privilege escalation caused by improper user identity validation in password update functionality, letting unauthenticated attackers change arbitrary user passwords, including administrators, exploit requires crafted request.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-14998.yaml"}
{"ID":"CVE-2025-15403","Info":{"Name":"RegistrationMagic \u003c= 6.0.7.1 - Privilege Escalation","Severity":"critical","Description":"RegistrationMagic WordPress plugin \u003c= 6.0.7.1 contains a privilege escalation caused by improper access control in 'add_menu' via 'rm_user_exists' AJAX action, letting unauthenticated attackers manipulate admin menu capabilities, exploit requires subscriber user for further escalation.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-15403.yaml"}
{"ID":"CVE-2025-15503","Info":{"Name":"Sangfor OSM - Arbitrary File Upload","Severity":"critical","Description":"Sangfor Operation and Maintenance Management System \u003c= 3.0.8 contains an unrestricted file upload vulnerability caused by manipulation of the \\\"File\\\" argument in /fort/trust/version/common/common.jsp, letting remote attackers upload arbitrary files, exploit requires no special privileges.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-15503.yaml"}
{"ID":"CVE-2025-1562","Info":{"Name":"Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control","Severity":"critical","Description":"The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the install_or_activate_addon_plugins() function and a weak nonce hash in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to install arbitrary plugins on the site that can be leveraged to further infect a vulnerable site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-1562.yaml"}
{"ID":"CVE-2025-1595","Info":{"Name":"EasyCVR \u003c=2.1.2 - Information Disclosure","Severity":"medium","Description":"A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code of the file /api/v1/getbaseconfig. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-1595.yaml"}
@@ -3650,7 +3674,7 @@
{"ID":"CVE-2025-29306","Info":{"Name":"FoxCMS v.1.2.5 - Remote Code Execution","Severity":"critical","Description":"An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-29306.yaml"}
{"ID":"CVE-2025-29635","Info":{"Name":"D-Link DIR-823X set_prohibiting - Command Injection","Severity":"high","Description":"D-Link DIR-823X 240126 and 240802 contain a command injection caused by sending a POST request to /goform/set_prohibiting, letting an authorized attacker execute arbitrary commands remotely, exploit requires attacker to be authorized.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2025/CVE-2025-29635.yaml"}
{"ID":"CVE-2025-29925","Info":{"Name":"XWiki REST API - Private Pages Disclosure","Severity":"high","Description":"A vulnerability in XWiki's REST API allows unauthenticated users to access information about private pages through the pages endpoint. This could lead to disclosure of sensitive information and page metadata.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-29925.yaml"}
{"ID":"CVE-2025-29927","Info":{"Name":"Next.js Middleware Bypass","Severity":"critical","Description":"Next.js contains a critical middleware bypass vulnerability affecting versions 11.1.4 through 15.2.2.\nThe vulnerability allows attackers to bypass middleware security controls by sending a specially crafted\n'x-middleware-subrequest' header, which can lead to authorization bypass and other security control circumvention.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2025/CVE-2025-29927.yaml"}
{"ID":"CVE-2025-29927","Info":{"Name":"Next.js Middleware Bypass","Severity":"critical","Description":"Next.js contains a critical middleware bypass vulnerability affecting versions 11.1.4 through 15.2.2.\nAttackers may bypass middleware by sending a craftedx-middleware-subrequest header. This template\nrequires a baseline middleware redirect before accepting a bypass 200 response.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2025/CVE-2025-29927.yaml"}
{"ID":"CVE-2025-30208","Info":{"Name":"Vite - Arbitrary File Read","Severity":"medium","Description":"Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import\u0026raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-30208.yaml"}
{"ID":"CVE-2025-30220","Info":{"Name":"GeoServer WFS - XXE Processing Vulnerability","Severity":"critical","Description":"GeoServer Web Feature Service (WFS) is vulnerable to an XML External Entity (XXE) processing attack due to improper handling of XML input. This vulnerability allows attackers to perform Out-of-Band (OOB) data exfiltration and Server-Side Request Forgery (SSRF) by exploiting the GeoTools library.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2025/CVE-2025-30220.yaml"}
{"ID":"CVE-2025-30406","Info":{"Name":"Gladinet CentreStack \u003c 16.4.10315.56368 Use of Hard-coded Key Leads to Unauthenticated RCE","Severity":"critical","Description":"Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-30406.yaml"}
@@ -3684,6 +3708,7 @@
{"ID":"CVE-2025-34030","Info":{"Name":"sar2html \u003c=3.2.2 Plot Parameter - Remote Code Execution","Severity":"critical","Description":"sar2html version 3.2.2 and prior contains an OS command injection vulnerability in the plot parameter of index.php. A remote, unauthenticated attacker can append shell metacharacters to the plot parameter and execute arbitrary operating system commands.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2025/CVE-2025-34030.yaml"}
{"ID":"CVE-2025-34031","Info":{"Name":"Moodle Jmol Filter 6.1 - Local File Inclusion","Severity":"high","Description":"Moodle Jmol Filter 6.1 is vulnerable to local file inclusion through the jsmol.php file, allowing attackers to read arbitrary files on the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-34031.yaml"}
{"ID":"CVE-2025-34032","Info":{"Name":"Moodle LMS Jmol Plugin \u003c= 6.1 - Cross-Site Scripting","Severity":"medium","Description":"A reflected cross-site scripting (XSS) vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript in the victim's browser by crafting a malicious link. This can be used to hijack user sessions or manipulate page content.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-34032.yaml"}
{"ID":"CVE-2025-34033","Info":{"Name":"Blue Angel Software Suite (5V Technologies) - OS Command Injection","Severity":"high","Description":"Blue Angel 5V Technologies Blue Angel Software Suite through 20230920, as used in Analog Telephone Adapter (ATA) and Voice over IP (VoIP) devices, allows remote authenticated attackers to execute arbitrary OS commands as root via shell metacharacters in the ping_addr parameter to webctrl.cgi?action=pingtest_update.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2025/CVE-2025-34033.yaml"}
{"ID":"CVE-2025-34035","Info":{"Name":"EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Root Remote Code Execution","Severity":"critical","Description":"An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier.The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands.The injected commands are executed with root privileges, leading to full system compromise.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2025/CVE-2025-34035.yaml"}
{"ID":"CVE-2025-34038","Info":{"Name":"Fanwei e-cology - SQL Injection","Severity":"high","Description":"Fanwei e-cology 8.0 contains a sql injection caused by unsanitized user input in the sql parameter of getdata.jsp, letting unauthenticated attackers execute arbitrary SQL queries and access sensitive data.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-34038.yaml"}
{"ID":"CVE-2025-34040","Info":{"Name":"Zhiyuan OA Platform - Arbitrary File Upload","Severity":"critical","Description":"An arbitrary file upload vulnerability exists in the Zhiyuan OA platform 5.0, 5.1 - 5.6sp1, 6.0 - 6.1sp2, 7.0, 7.0sp1 - 7.1, 7.1sp1, and 8.0 - 8.0sp2 via the wpsAssistServlet interface. The realFileType and fileId parameters are improperly validated during multipart file uploads, allowing unauthenticated attackers to upload crafted JSP files outside of intended directories using path traversal. Successful exploitation enables remote code execution as the uploaded file can be accessed and executed through the web server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-34040.yaml"}
@@ -3774,6 +3799,7 @@
{"ID":"CVE-2025-51501","Info":{"Name":"Microweber CMS2.0 - Cross-Site Scripting","Severity":"medium","Description":"Reflected Cross-Site Scripting (XSS) in the `id` parameter of the `live_edit.module_settings` API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-51501.yaml"}
{"ID":"CVE-2025-51502","Info":{"Name":"Microweber CMS 2.0 - Reflected XSS in Admin Page Creation","Severity":"medium","Description":"Reflected Cross-Site Scripting (XSS) exists in Microweber CMS 2.0 through the layout parameter on the /admin/page/create page. It allows arbitrary JavaScript to execute in the context of authenticated admin users.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-51502.yaml"}
{"ID":"CVE-2025-51586","Info":{"Name":"PrestaShop - Information Disclosure","Severity":"medium","Description":"User enumeration vulnerability in the AdminLogin controller in PrestaShop 1.7 through 8.2.2 allows remote attackers to obtain administrators user email addresses via manipulation of the id_employee and reset_token parameters. An attacker who has access to the Back Office login URL can trigger the password reset form to disclose the associated email address in a hidden field, even when the provided reset token is invalid. This issue has been fixed in 8.2.3.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-51586.yaml"}
{"ID":"CVE-2025-51683","Info":{"Name":"mJobTime \u003c= 15.7.2 - Unauthenticated Blind SQL Injection to RCE","Severity":"critical","Description":"mJobtime v15.7.2 contains a sql injection caused by crafted POST request to /Default.aspx/update_profile_Server, letting unauthenticated attackers execute arbitrary SQL statements remotely, exploit requires no special privileges.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-51683.yaml"}
{"ID":"CVE-2025-51990","Info":{"Name":"XWiki – Stored Cross-Site Scripting (XSS)","Severity":"medium","Description":"XWiki through version 17.3.0 contains stored cross-site scripting caused by improper sanitization of inputs in the Administration interface's Presentation section, letting authenticated administrators inject JavaScript that executes in visitors' browsers, exploit requires administrator authentication.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2025/CVE-2025-51990.yaml"}
{"ID":"CVE-2025-51991","Info":{"Name":"XWiki \u003c= 17.3.0 - Server-Side Template Injection (SSTI)","Severity":"critical","Description":"XWiki \u003c= 17.3.0 contains a server-side template injection caused by improper validation of Apache Velocity template code in the Administration interface HTTP Meta Info field, letting authenticated administrators execute arbitrary template logic.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2025/CVE-2025-51991.yaml"}
{"ID":"CVE-2025-52207","Info":{"Name":"MikoPBX - Unrestricted File Upload","Severity":"critical","Description":"MikoPBX through 2024.1.114 contains an authenticated unrestricted file upload vulnerability caused by allowing PHP script uploads in PBXCoreREST/Controllers/Files/PostController.php.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2025/CVE-2025-52207.yaml"}
@@ -3794,6 +3820,7 @@
{"ID":"CVE-2025-53770","Info":{"Name":"Microsoft SharePoint Server - Remote Code Execution (ToolShell)","Severity":"critical","Description":"Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. This vulnerability is part of the ToolShell exploit chain and when combined with CVE-2025-53771 (authentication bypass), enables unauthenticated remote code execution. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-53770.yaml"}
{"ID":"CVE-2025-53771","Info":{"Name":"Microsoft SharePoint Server - Authentication Bypass (ToolShell)","Severity":"medium","Description":"Microsoft Office SharePoint Server contains an improper authentication vulnerability that allows unauthorized attackers to perform spoofing over a network. By crafting a POST request to /_layouts/15/ToolPane.aspx with a forged Referer header (/_layouts/SignOut.aspx), attackers can bypass authentication mechanisms and gain unauthorized access to protected endpoints. This vulnerability is part of the ToolShell exploit chain and is a patch bypass for CVE-2025-49706. When chained with CVE-2025-53770 (deserialization vulnerability), it enables unauthenticated remote code execution on SharePoint Server.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2025/CVE-2025-53771.yaml"}
{"ID":"CVE-2025-53833","Info":{"Name":"LaRecipe \u003c 2.8.1 Remote Code Execution via SSTI","Severity":"critical","Description":"LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection (SSTI), which could potentially lead to Remote Code Execution (RCE) in vulnerable configurations.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2025/CVE-2025-53833.yaml"}
{"ID":"CVE-2025-53887","Info":{"Name":"Directus \u003c 11.9.0 - Version Disclosure","Severity":"medium","Description":"Directus versions from 9.0.0 before 11.9.0 expose the exact running version through the OpenAPI specification returned by the unauthenticated /server/specs/oas endpoint. The version is placed in the OpenAPI info.version field, letting an unauthenticated attacker fingerprint the precise Directus release. The fix replaces the exact version in that field with a hashed value.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-53887.yaml"}
{"ID":"CVE-2025-5394","Info":{"Name":"Unauthenticated Arbitrary Plugin Upload in Alone Theme","Severity":"critical","Description":"The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the alone_import_pack_install_plugin() function in all versions up to, and including, 7.8.3.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-5394.yaml"}
{"ID":"CVE-2025-54068","Info":{"Name":"Laravel Livewire v3 - Remote Command Execution","Severity":"critical","Description":"Livewire v3 (Laravel) contains a vulnerability in its component hydration/update mechanism that can be exploited to reach remote command execution (RCE) without authentication under certain conditions.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-54068.yaml"}
{"ID":"CVE-2025-54123","Info":{"Name":"Hoverfly \u003c= 1.11.3 - Remote Code Execution","Severity":"critical","Description":"Hoverfly versions 1.11.3 and below are vulnerable to remote code execution (RCE) via command injection in the middleware API endpoint (/api/v2/hoverfly/middleware). Insufficient validation of the 'binary' and 'script' parameters allows an unauthenticated attacker to execute arbitrary commands on the host system.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-54123.yaml"}
@@ -3811,7 +3838,7 @@
{"ID":"CVE-2025-55161","Info":{"Name":"Stirling-PDF SSRF via Markdown","Severity":"high","Description":"Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/markdown/pdf endpoint to convert Markdown to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security sanitization which can be bypassed and result in SSRF.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2025/CVE-2025-55161.yaml"}
{"ID":"CVE-2025-55169","Info":{"Name":"WeGIA - Directory Traversal","Severity":"critical","Description":"WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a path traversal vulnerability was discovered in the WeGIA application, html/socio/sistema/download_remessa.php endpoint. This vulnerability could allow an attacker to gain unauthorized access to local files in the server and sensitive information stored in config.php. config.php contains information that could allow direct access to the database. This issue has been patched in version 3.4.8.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-55169.yaml"}
{"ID":"CVE-2025-55182","Info":{"Name":"React Server Components - Remote Code Execution","Severity":"critical","Description":"React Server Components 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including react-server-dom-parcel,\nreact-server-dom-turbopack, and react-server-dom-webpack contain a remote code execution caused\nby unsafe deserialization of payloads from HTTP requests to Server Function endpoints, letting\nunauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-55182.yaml"}
{"ID":"CVE-2025-55184","Info":{"Name":"React Server Components - Denial of Service","Severity":"high","Description":"React Server Components 19.0.0 to 19.2.1 including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack contain an insecure deserialization vulnerability caused by unsafe payload deserialization in Server Function endpoints, letting unauthenticated attackers cause denial of service by hanging the server process.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-55184.yaml"}
{"ID":"CVE-2025-55184","Info":{"Name":"React Server Components - Denial of Service","Severity":"high","Description":"React Server Components 19.0.0 to 19.2.1 including react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack contain an insecure deserialization vulnerability caused by unsafe payload deserialization in Server Function endpoints, letting unauthenticated attackers cause denial of service by hanging the server process.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-55184.yaml"}
{"ID":"CVE-2025-55190","Info":{"Name":"ArgoCD Project API Token Repository Credentials Exposure","Severity":"critical","Description":"Argo CD API tokens with project-level permissions are able to retrieve sensitive repository credentials\n(usernames, passwords) through the project details API endpoint, even when the token only has standard\napplication management permissions and no explicit access to secrets. This vulnerability affects versions\nv2.2.0-rc1 and later, including 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12,\nand 3.1.0-rc1 through 3.1.1. Any token with project get permissions is vulnerable, including global permissions.\nNote: This template requires valid ArgoCD credentials (username/password) to test the vulnerability.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2025/CVE-2025-55190.yaml"}
{"ID":"CVE-2025-55303","Info":{"Name":"Astro - Unauthorized Third-Party Image Access","Severity":"medium","Description":"Astro \u003c 5.13.2 and \u003c 4.16.18 contains an information disclosure vulnerability caused by improper validation of protocol-relative URLs in the image optimization endpoint, letting attackers serve images from unauthorized third-party domains, exploit requires on-demand rendering deployment.\n","Classification":{"CVSSScore":"6.4"}},"file_path":"http/cves/2025/CVE-2025-55303.yaml"}
{"ID":"CVE-2025-55523","Info":{"Name":"Agent-Zero 0.8.0 - 0.9.4 - Arbitrary File Download","Severity":"high","Description":"Agent-Zero v0.8.0 - 0.9.4 contains a path traversal caused by improper validation in /api/download_work_dir_file.py, letting attackers access unauthorized files, exploit requires crafted request.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-55523.yaml"}
@@ -3826,6 +3853,7 @@
{"ID":"CVE-2025-56520","Info":{"Name":"Dify v1.6.0 - Server-Side Request Forgery","Severity":"high","Description":"Dify v1.6.0 contains a server side request forgery caused by improper validation in controllers.console.remote_files.RemoteFileUploadApi, letting attackers make arbitrary requests from the server, exploit requires network access.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2025/CVE-2025-56520.yaml"}
{"ID":"CVE-2025-56819","Info":{"Name":"Datart v1.0.0-rc.3 - Remote Code Execution","Severity":"critical","Description":"Datart v1.0.0-rc.3 contains a vulnerability that allows remote attackers to execute arbitrary code via INIT connection parameters.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-56819.yaml"}
{"ID":"CVE-2025-5701","Info":{"Name":"HyperComments \u003c= 1.2.2 - Arbitrary Options Update","Severity":"critical","Description":"The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hc_request_handler function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-5701.yaml"}
{"ID":"CVE-2025-57231","Info":{"Name":"Docmost 0.2.1-0.21.0 - Arbitrary File Read","Severity":"high","Description":"Docmost v0.21.0 contains a path traversal caused by improper handling of avatar attachments, letting unauthenticated attackers disclose local files via a POST request on a public URL.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-57231.yaml"}
{"ID":"CVE-2025-5777","Info":{"Name":"Citrix NetScaler Memory Disclosure - CitrixBleed 2","Severity":"critical","Description":"Insufficient input validation leading to memory overread on the NetScaler Management Interface NetScaler ADC and NetScaler Gateway\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-5777.yaml"}
{"ID":"CVE-2025-57788","Info":{"Name":"Commvault Unauthenticated Password Disclosure (WT-2025-0047)","Severity":"medium","Description":"An issue was discovered in Commvault before 11.36.60. A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. RBAC helps limit the exposure but does not eliminate risk.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-57788.yaml"}
{"ID":"CVE-2025-57789","Info":{"Name":"Commvault Initial Administrator Login Process Vulnerability","Severity":"medium","Description":"An issue was discovered in Commvault before 11.36.60.During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control. This is limited to the setup phase, before any jobs have been configured.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-57789.yaml"}
@@ -3837,7 +3865,7 @@
{"ID":"CVE-2025-58226","Info":{"Name":"WordPress 3D FlipBook Plugin \u003c= 1.16.17 - Sensitive Information Exposure","Severity":"medium","Description":"The 3D FlipBook WordPress plugin (≤ v1.16.17) has a vulnerability where an unauthenticated AJAX action (fb3d_send_posts) exposes sensitive data. Attackers can access all flipbook posts—including password-protected content, metadata, PDF URLs, and plugin settings—without authorization.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-58226.yaml"}
{"ID":"CVE-2025-58360","Info":{"Name":"GeoServer - XML External Entity Injection","Severity":"high","Description":"GeoServer 2.26.0 to 2.26.2 and 2.25.6 contains an XML External Entity (XXE) injection caused by insufficient sanitization of XML input in /geoserver/wms GetMap operation, letting attackers disclose files or cause DoS, exploit requires crafted XML input.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2025/CVE-2025-58360.yaml"}
{"ID":"CVE-2025-58434","Info":{"Name":"Flowise \u003c= 3.0.5 - Account Takeover","Severity":"critical","Description":"Flowise versions 3.0.5 and earlier had a vulnerability in the forgot-password endpoint, which returned valid reset tokens without authentication—allowing attackers to reset passwords and take over accounts.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-58434.yaml"}
{"ID":"CVE-2025-58443","Info":{"Name":"FOGProject \u003c= 1.5.10.1673 - Authentication Bypass","Severity":"critical","Description":"FOGProject version 1.5.10.1673 suffers from an authentication bypass vulnerability that allows unauthenticated users to access the management interface without proper authentication. This can lead to unauthorized access to system configuration, host management, and potentially database information.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2025/CVE-2025-58443.yaml"}
{"ID":"CVE-2025-58443","Info":{"Name":"FOGProject \u003c 1.5.10.1693 - Authentication Bypass","Severity":"critical","Description":"FOGProject version 1.5.10.1673 suffers from an authentication bypass vulnerability that allows unauthenticated users to access the management interface without proper authentication. This can lead to unauthorized access to system configuration, host management, and potentially database information.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2025/CVE-2025-58443.yaml"}
{"ID":"CVE-2025-58751","Info":{"Name":"Vite Dev Server - Path Traversal","Severity":"low","Description":"Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-58751.yaml"}
{"ID":"CVE-2025-59049","Info":{"Name":"Mockoon \u003c 9.2.0 - Path Traversal","Severity":"high","Description":"Mockoon before 9.2.0 contains a path traversal and local file inclusion caused by unsafe templating of server filenames from user input, letting attackers read arbitrary files on the mock server filesystem, exploit requires crafted request.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-59049.yaml"}
{"ID":"CVE-2025-59136","Info":{"Name":"WordPress Gerencianet Oficial \u003c= 3.1.3 - Unauthenticated Order Status Disclosure","Severity":"medium","Description":"Efí Bank Gerencianet Oficial \u003c= 3.1.3 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve embedded sensitive data, exploit requires crafted requests.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-59136.yaml"}
@@ -3866,6 +3894,7 @@
{"ID":"CVE-2025-62168","Info":{"Name":"Squid Proxy - HTTP Authentication Credentials Disclosure","Severity":"critical","Description":"Squid versions prior to 7.2 fail to redact HTTP authentication credentials in error page responses. The Authorization header value is embedded in plain text inside the mailto: diagnostic block when Squid generates an error page (e.g. ERR_DNS_FAIL).\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2025/CVE-2025-62168.yaml"}
{"ID":"CVE-2025-62512","Info":{"Name":"Piwigo - User Enumeration via Password Reset","Severity":"medium","Description":"Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the password reset functionality in Piwigo allows an unauthenticated attacker to determine whether a given username or email address exists in the system. The endpoint at password.php?action=lost returns distinct messages for valid vs. invalid accounts, enabling user enumeration. As of time of publication, no known patches are available.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-62512.yaml"}
{"ID":"CVE-2025-62522","Info":{"Name":"Vite - Information Disclosure","Severity":"medium","Description":"Vite is a frontend tooling framework for JavaScript.In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \\ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-62522.yaml"}
{"ID":"CVE-2025-62593","Info":{"Name":"Ray \u003c 2.52.0 - Remote Code Execution","Severity":"critical","Description":"Ray versions prior to 2.52.0 allow unauthenticated remote code execution via the job submission API at /api/jobs/. A weak User-Agent heuristic (rejecting Mozilla-prefixed headers) can be bypassed by non-browser clients, enabling arbitrary command execution when the dashboard is network-reachable.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-62593.yaml"}
{"ID":"CVE-2025-62613","Info":{"Name":"VDO.Ninja - DOM-Based Cross-Site Scripting","Severity":"medium","Description":"VDO.Ninja 28.0 to 28.3 contains a reflected XSS caused by improper sanitization of the room parameter in examples/control.html, letting remote attackers execute scripts, exploit requires crafted URL.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2025/CVE-2025-62613.yaml"}
{"ID":"CVE-2025-62780","Info":{"Name":"ChangeDetection.io \u003c= v0.50.33 - Stored XSS via Watch API","Severity":"medium","Description":"changedetection.io \u003c= 0.50.34 contains a stored cross site scripting caused by insufficient security checks in the Watch update API, letting attackers execute arbitrary JavaScript when users preview malicious links, exploit requires user interaction\n","Classification":{"CVSSScore":"6.2"}},"file_path":"http/cves/2025/CVE-2025-62780.yaml"}
{"ID":"CVE-2025-63387","Info":{"Name":"Dify v1.9.1 - Broken Access Control","Severity":"medium","Description":"Dify v1.9.1 contains an insecure permissions vulnerability caused by lack of authorization checks in /console/api/system-features endpoint, letting unauthenticated attackers access sensitive system configuration data.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-63387.yaml"}
@@ -3882,6 +3911,7 @@
{"ID":"CVE-2025-66744","Info":{"Name":"Yonyou YonBIP - Path Traversal","Severity":"high","Description":"Yonyou YonBIP v3 and before contains a path traversal caused by improper validation in the LoginWithV8 interface of the series data application service system, letting unauthorized attackers access sensitive information.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-66744.yaml"}
{"ID":"CVE-2025-67303","Info":{"Name":"ComfyUI-Manager \u003c 3.38 - Configuration Overwrite","Severity":"critical","Description":"ComfyUI-Manager \u003c 3.38 contains an insecure file storage vulnerability caused by storing files in an insufficiently protected location accessible via the web interface, letting remote attackers manipulate configuration and critical data, exploit requires web access.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2025/CVE-2025-67303.yaml"}
{"ID":"CVE-2025-68043","Info":{"Name":"LottieFiles WordPress Plugin \u003c= 3.0.0 - Missing Authorization","Severity":"high","Description":"LottieFiles LottieFiles \u003c= 3.0.0 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers exploit missing authorization, exploit requires no special privileges.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2025/CVE-2025-68043.yaml"}
{"ID":"CVE-2025-68273","Info":{"Name":"Signal K Server \u003c= 2.18.0 - Information Disclosure","Severity":"medium","Description":"Signal K Server versions up to and including 2.18.0 expose the /skServer/serialports, /skServer/availablePaths, and /skServer/hasAnalyzer endpoints without authentication. These routes were missing from the authentication middleware configuration, letting any unauthenticated user retrieve the full Signal K data schema, the list of connected serial devices, and whether traffic analyzer tools are installed. This template fingerprints the server via the public /signalk discovery endpoint and flags builds older than the fixed 2.19.0 release.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2025/CVE-2025-68273.yaml"}
{"ID":"CVE-2025-68493","Info":{"Name":"Apache Struts XWork - XML External Entity Injection","Severity":"high","Description":"Apache Struts 2.0.0 \u003c 2.2.1 and 2.2.1 \u003c= versions \u003c= 6.1.0 contain an XML external entity injection caused by missing XML validation, letting attackers potentially disclose files or cause denial of service, exploit requires crafted XML input\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2025/CVE-2025-68493.yaml"}
{"ID":"CVE-2025-68509","Info":{"Name":"User Submitted Posts \u003c= 20251121 - Unauthenticated Open Redirect","Severity":"medium","Description":"The User Submitted Posts plugin for WordPress is vulnerable to Open Redirect in all versions up to and including 20251121. This is due to insufficient validation on the redirect-override POST parameter. Unauthenticated attackers can redirect users to potentially malicious sites by tricking them into submitting a form.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-68509.yaml"}
{"ID":"CVE-2025-6851","Info":{"Name":"WordPress Broken Link Notifier \u003c 1.3.1 - Unauthenticated SSRF","Severity":"high","Description":"The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajax_blinks() function which ultimately calls the check_url_status_code() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2025/CVE-2025-6851.yaml"}
@@ -3912,53 +3942,138 @@
{"ID":"CVE-2025-9744","Info":{"Name":"Loan Management System 1.0 - SQL Injection","Severity":"critical","Description":"Loan Management System 1.0 contains a SQL injection vulnerability via the username parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2025/CVE-2025-9744.yaml"}
{"ID":"CVE-2025-9808","Info":{"Name":"The Events Calendar \u003c= 6.15.2 - Information Disclosure","Severity":"medium","Description":"The Events Calendar WordPress plugin \u003c= 6.15.2 contains an information disclosure vulnerability caused by REST endpoint exposure, letting unauthenticated attackers extract data about password-protected vendors or venues, exploit requires no authentication.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-9808.yaml"}
{"ID":"CVE-2025-9985","Info":{"Name":"Featured Image from URL (FIFU) \u003c= 5.2.7 - Unauthenticated Information Exposure via Log File","Severity":"medium","Description":"The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2025/CVE-2025-9985.yaml"}
{"ID":"CVE-2025-14047","Info":{"Name":"User Frontend \u003c= 4.2.4 - Missing Authorization to Unauthenticated Attachment Deletion","Severity":"medium","Description":"The WP User Frontend plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check in the Frontend_Form_Ajax::submit_post function.\nThis makes it possible for unauthenticated attackers to delete attachment records through the plugin's AJAX handling when a public frontend form is available.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2025-14047.yaml"}
{"ID":"CVE-2026-0545","Info":{"Name":"MLflow Job API - Authentication Bypass","Severity":"critical","Description":"MLflow latest version contains an authentication bypass caused by unprotected FastAPI job endpoints under /ajax-api/3.0/jobs/* when basic-auth is enabled, letting unauthenticated network clients submit and manage jobs, exploit requires job execution enabled and allowlisted job functions.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-0545.yaml"}
{"ID":"CVE-2026-0558","Info":{"Name":"LolLMS \u003c= 2.2.0 - Unauthenticated File Upload","Severity":"critical","Description":"A vulnerability in parisneo/lollms up to and including version 2.2.0 allows unauthenticated users to upload and process files through the /api/files/extract-text endpoint. The endpoint lacks the Depends(get_current_active_user) dependency used by other file-related APIs.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-0558.yaml"}
{"ID":"CVE-2026-0560","Info":{"Name":"LolLMS \u003c 2.2.0 - Server-Side Request Forgery","Severity":"high","Description":"A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0. The /api/files/export-content endpoint processes Markdown image URLs by downloading them via _download_image_to_temp() in backend/routers/files.py without any validation, allowing an unauthenticated attacker to supply arbitrary URLs (e.g. cloud metadata endpoints or internal services) that the server will fetch, enabling internal network access, cloud metadata access, information disclosure, port scanning, and potentially remote code execution.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-0560.yaml"}
{"ID":"CVE-2026-0561","Info":{"Name":"Shield Security \u003c= 21.0.8 - Unauthenticated Reflected XSS","Severity":"medium","Description":"Shield Security WordPress plugin \u003c= 21.0.8 contains a reflected cross-site scripting caused by insufficient input sanitization and output escaping in the 'message' parameter, letting unauthenticated attackers inject scripts, exploit requires user interaction.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-0561.yaml"}
{"ID":"CVE-2026-0594","Info":{"Name":"WordPress List Site Contributors \u003c 1.1.8 - Reflected XSS","Severity":"medium","Description":"WordPress List Site Contributors plugin \u003c 1.1.8 contains a reflected XSS caused by insufficient sanitization and escaping of the 'alpha' parameter, letting unauthenticated attackers inject scripts, exploit requires user interaction.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-0594.yaml"}
{"ID":"CVE-2026-0650","Info":{"Name":"OpenFlagr \u003c= 1.1.18 - Authentication Bypass","Severity":"critical","Description":"OpenFlagr \u003c= 1.1.18 contains an authentication bypass caused by improper path normalization handling in HTTP middleware whitelist logic, letting attackers access protected API endpoints without valid credentials, exploit requires crafted requests.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-0650.yaml"}
{"ID":"CVE-2026-0692","Info":{"Name":"BlueSnap Payment Gateway for WooCommerce \u003c=3.4.0 - IPN Authorization Bypass","Severity":"high","Description":"BlueSnap Payment Gateway for WooCommerce \u003c= 3.4.0 validates its unauthenticated IPN webhook using WooCommerce's client-IP geolocation, which trusts spoofed forwarding headers instead of requiring a webhook signature. Version 3.4.1 replaces the IP check with HMAC-SHA256 security headers. This detector supplies a generated, non-existent transaction ID, so the vulnerable code reaches the order lookup and returns `Order could not be found` without changing an order.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-0692.yaml"}
{"ID":"CVE-2026-0702","Info":{"Name":"VidShop for WooCommerce \u003c= 1.1.4 - SQL Injection","Severity":"high","Description":"VidShop – Shoppable Videos for WooCommerce plugin for WordPress \u003c= 1.1.4 contains a time-based SQL injection caused by insufficient escaping of the 'fields' parameter, letting unauthenticated attackers extract sensitive database information.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-0702.yaml"}
{"ID":"CVE-2026-0717","Info":{"Name":"LottieFiles for Gutenberg \u003c= 3.0.0 - Unauthenticated Settings Disclosure","Severity":"medium","Description":"The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the `/wp-json/lottiefiles/v1/settings/` REST API endpoint. This makes it possible for unauthenticated attackers to retrieve the site owner's LottieFiles.com account credentials including their API access token and email address when the 'Share LottieFiles account with other WordPress users' option is enabled.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-0717.yaml"}
{"ID":"CVE-2026-0740","Info":{"Name":"Ninja Forms File Uploads \u003c= 3.3.26 - Arbitrary File Upload","Severity":"critical","Description":"Ninja Forms File Uploads plugin for WordPress versions up to and including 3.3.26 is vulnerable to unauthenticated arbitrary file upload which could lead to remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-0740.yaml"}
{"ID":"CVE-2026-0743","Info":{"Name":"WP Content Permission \u003c= 1.2 - Cross-Site Scripting","Severity":"medium","Description":"The WP Content Permission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ohmem-message' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.\n","Classification":{"CVSSScore":"4.4"}},"file_path":"http/cves/2026/CVE-2026-0743.yaml"}
{"ID":"CVE-2026-0768","Info":{"Name":"Langflow \u003c=1.2.x - Unauthenticated Remote Code Execution via validate_code","Severity":"critical","Description":"Langflow \u003c= 1.2.x exposes POST /api/v1/validate/code without any authentication. The endpoint calls validate_code() which exec()s user-supplied Python code. Default-argument expressions in Python execute at function-definition time, allowing arbitrary OS command execution without authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-0768.yaml"}
{"ID":"CVE-2026-0770","Info":{"Name":"Langflow \u003c 1.3.0 - Remote Code Execution via validate_code() exec()","Severity":"critical","Description":"Langflow contains a remote code execution caused by inclusion of functionality from untrusted control sphere in the exec_globals parameter at the validate endpoint, letting remote attackers execute arbitrary code as root, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-0770.yaml"}
{"ID":"CVE-2026-0829","Info":{"Name":"Frontend File Manager Plugin \u003c= 23.5 - Unauthenticated Arbitrary Email Sending","Severity":"high","Description":"Frontend File Manager Plugin WordPress plugin through 23.5 contains an open relay and unauthorized file access vulnerability caused by lack of authentication and security checks, letting unauthenticated attackers send emails and access files, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-0829.yaml"}
{"ID":"CVE-2026-0926","Info":{"Name":"Prodigy Commerce \u003c= 3.3.0 - Local File Inclusion","Severity":"critical","Description":"Prodigy Commerce WordPress plugin \u003c= 3.2.9 contains a local file inclusion caused by improper sanitization of 'parameters[template_name]' parameter, letting unauthenticated attackers include and execute arbitrary files remotely.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-0926.yaml"}
{"ID":"CVE-2026-102764","Info":{"Name":"BeyondTrust Remote Support \u003c= 26.2.3 - Origin Validation File Upload","Severity":"critical","Description":"The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-102764.yaml"}
{"ID":"CVE-2026-102782","Info":{"Name":"OrdaSoft Simple Membership \u003c 7.4.0 - SQL Injection","Severity":"critical","Description":"OrdaSoft Simple Membership (com_simplemembership) for Joomla before 7.4.0 is vulnerable to unauthenticated SQL injection via the 'login' parameter of the checkLoginPass task (site/simplemembership.php). The handler passes the value through Joomla's generic input filter, which strips HTML but leaves quotes and SQL syntax intact, and concatenates it directly into the SQL query with no escaping or parameter binding. Error-based injection via extractvalue() lets unauthenticated attackers exfiltrate database contents.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-102782.yaml"}
{"ID":"CVE-2026-102878","Info":{"Name":"mcp-chrome-bridge (hangwin/mcp-chrome) \u003c= 1.0.31 - CORS Origin Bypass (CSWSH)","Severity":"high","Description":"mcp-chrome-bridge \u003c=1.0.31 uses origin.startsWith for CORS, so origins like http://127.0.0.1.evil.com are wrongly allowed, letting attackers bypass CORS and access the local server.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2026/CVE-2026-102878.yaml"}
{"ID":"CVE-2026-103956","Info":{"Name":"Loom for AWS \u003c 1.6.1 - Unauthenticated Super-Admin Access","Severity":"critical","Description":"Loom for AWS \u003c 1.6.1 contains a broken authentication caused by missing authentication for critical functions in the authentication dependency, letting remote actors obtain super-admin authority over the agent control plane, exploit requires no identity provider configured.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2026/CVE-2026-103956.yaml"}
{"ID":"CVE-2026-104736","Info":{"Name":"LearnPress \u003c= 4.4.9.1 - PHP Object Injection","Severity":"critical","Description":"LearnPress WordPress plugin \u003c= 4.4.10 contains a PHP Object Injection caused by deserialization of untrusted 'checkout-email' parameter in checkout AJAX action, letting unauthenticated attackers inject PHP objects remotely.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-104736.yaml"}
{"ID":"CVE-2026-104935","Info":{"Name":"Ivanti Connect Secure \u003c= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH Header","Severity":"critical","Description":"Ivanti Connect Secure VPN appliances contain an authentication bypass vulnerability in how the appliance routes requests from front- and back-end processes to CGI script handlers. The URL path is used to determine whether a request is allowed (welcome.cgi is public), while the X-DSCGI-PATH header determines the actual destination of the request. An attacker can send a request to the unauthenticated welcome.cgi endpoint with an X-DSCGI-PATH header pointing to an authenticated CGI script such as wu.cgi, bypassing authentication entirely. This vulnerability is chained with a file write race condition in wu.cgi and a privilege escalation via dsinvoked DSCache trust to achieve unauthenticated root-level remote code execution.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-104935.yaml"}
{"ID":"CVE-2026-105133","Info":{"Name":"AhsayCBS - JSON API Authentication Bypass","Severity":"medium","Description":"Ahsay AhsayCBS \u003c= 10.3.2 contains an authentication bypass caused by manipulation of the \"random\" argument in checkSysPwd function of API component, letting remote attackers bypass authentication, exploit requires crafted argument manipulation.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2026/CVE-2026-105133.yaml"}
{"ID":"CVE-2026-105134","Info":{"Name":"AhsayCBS \u003c= 10.3.4 - Unauthenticated RCE","Severity":"critical","Description":"Ahsay AhsayCBS \u003c= 10.3.2 contains a command injection caused by manipulation of the \\\"random\\\" argument in /rps/api/json/UpdateReceivers.do of Replication Receiver, letting remote attackers execute OS commands, exploit requires crafted request\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-105134.yaml"}
{"ID":"CVE-2026-10520","Info":{"Name":"Ivanti Sentry - OS Command Injection","Severity":"critical","Description":"An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-10520.yaml"}
{"ID":"CVE-2026-10525","Info":{"Name":"NEX-Forms Express WP Form Builder \u003c 9.2.3 - Unauthenticated Stored XSS","Severity":"high","Description":"NEX-Forms Express WP Form Builder plugin for WordPress before 9.2.3 is vulnerable to unauthenticated stored Cross-Site Scripting. The plugin registers a wp_ajax_nopriv_submit_nex_form handler for form submissions. Array-type field values are processed through rest_sanitize_array(), which only reindexes the array and performs no HTML sanitization, so markup is stored verbatim. When an administrator views the submitted entries, the stored payload renders without esc_html() escaping and executes arbitrary JavaScript in the admin's browser. Scalar fields are not affected (they are passed through strip_tags()).\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-10525.yaml"}
{"ID":"CVE-2026-105740","Info":{"Name":"Langflow 1.8.3 and 1.9.0 - Authenticated MCP Stdio Command Execution","Severity":"critical","Description":"An authenticated user can register an MCP stdio server command that executes\nwhen Langflow lists server actions. The 1.9.0 REST validation can be bypassed\nby placing arguments in the command field. This probe runs a short Python\ncallback, verifies an out-of-band DNS lookup, and removes its server config.\nThe equivalent sink is hardened in 1.10.3.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2026/CVE-2026-105740.yaml"}
{"ID":"CVE-2026-10580","Info":{"Name":"Hippoo Mobile App for WooCommerce \u003c= 1.9.4 - Authentication Bypass to Admin Account Takeover","Severity":"critical","Description":"Hippoo Mobile App for WooCommerce WordPress plugin \u003c= 1.9.4 contains an authentication bypass caused by logic conflation in user permission checks, letting unauthenticated attackers take over administrator accounts via REST API password reset.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-10580.yaml"}
{"ID":"CVE-2026-10768","Info":{"Name":"Drupal LocalGov Workflows \u003c 1.6.0 - Information Disclosure","Severity":"high","Description":"Drupal LocalGov Workflows \u003c 1.6.0 contains a broken access control vulnerability caused by missing authorization checks, letting attackers perform forceful browsing to access unauthorized resources, exploit requires no special privileges.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-10768.yaml"}
{"ID":"CVE-2026-108123","Info":{"Name":"WP Booking System \u003c= 2.1.0.3 - Unauthenticated Email Log Disclosure","Severity":"high","Description":"WP Booking System – Booking Calendar plugin for WordPress \u003c= 2.1.0.3 contains an authorization bypass caused by improper user authorization verification, letting unauthenticated attackers read stored notification emails exposing customer PII, exploit requires authenticated Subscriber-level user.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-108123.yaml"}
{"ID":"CVE-2026-10818","Info":{"Name":"WPForms Pro \u003c= 1.10.1.1 - Unauthenticated Arbitrary File Upload","Severity":"high","Description":"WPForms Pro for WordPress up to and including 1.10.1.1 allows unauthenticated arbitrary file upload. The wpforms_upload_chunk_init, wpforms_upload_chunk and wpforms_file_chunks_uploaded AJAX actions are registered for unauthenticated visitors without a nonce check, and raw chunk bytes are written under wp-content/uploads/wpforms/tmp/ before file extension and MIME type validation happens, so a rejected upload never removes the already written file. An unauthenticated attacker can plant arbitrary files and, depending on server configuration, achieve remote code execution.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2026/CVE-2026-10818.yaml"}
{"ID":"CVE-2026-10823","Info":{"Name":"YMC Filter WordPress - Unauthenticated Post Disclosure","Severity":"high","Description":"YMC Filter WordPress plugin \u003c 3.11.3 contains a broken access control vulnerability caused by improper authorization and lack of validation in a REST API endpoint, letting unauthenticated attackers retrieve private and non-public post content, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-10823.yaml"}
{"ID":"CVE-2026-108578","Info":{"Name":"Neterbit NW-431F - Unauthenticated SMS Disclosure","Severity":"medium","Description":"Neterbit NW-431F 20250715 contains an information disclosure vulnerability caused by manipulation in /sms.json of the Embedded Web Server, letting remote attackers access sensitive information, exploit requires no special conditions.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-108578.yaml"}
{"ID":"CVE-2026-109618","Info":{"Name":"PHP2Shell (CVE-2026-109618/CVE-2026-109619) - Active Crash Detection","Severity":"critical","Description":"PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).\n","Classification":{"CVSSScore":"9.2"}},"file_path":"http/cves/2026/CVE-2026-109618.yaml"}
{"ID":"CVE-2026-109619","Info":{"Name":"PHP 8.2 \u003c 8.2.35, 8.3 \u003c 8.3.36, 8.4 \u003c 8.4.27, 8.5 \u003c 8.5.12 - Use-After-Free Remote Code Execution","Severity":"critical","Description":"PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, and 8.5 before 8.5.12 contain a use-after-free caused by request-owned global state that is not reset before the request heap is freed, letting unauthenticated attackers execute arbitrary code in a subsequent request handled by the same worker; exploitation requires a crafted request sequence and a reachable session or INI consumer.\nThis template performs a passive version check against the PHP version disclosed in the X-Powered-By or Server response header and does not send a crafted request. It follows same-origin redirects (same host and port); redirects to another origin are ignored so a third-party response cannot be attributed to the scanned host. Limitations: detection requires the version to be exposed, so hosts with expose_php=Off and no PHP version in the Server header, hosts behind a proxy or FastCGI configuration that strips these headers, and applications that override them are not detected. These headers can also be spoofed, so a match is only as trustworthy as the disclosed header. Builds that backport the fix while keeping the upstream version number (for example 8.2.34-1ubuntu1) still match, so a match reports an affected upstream version rather than confirmed exploitability. Pre-release or development builds of a fixed version (for example 8.2.35RC1) and responses that advertise conflicting versions in different headers are not matched.\n","Classification":{"CVSSScore":"9.2"}},"file_path":"http/cves/2026/CVE-2026-109619.yaml"}
{"ID":"CVE-2026-110372","Info":{"Name":"WordPress OttoKit Plugin \u003c= 1.1.40 - Unauthenticated Privilege Escalation via connection-denied Token","Severity":"critical","Description":"OttoKit (formerly SureTriggers) WordPress plugin \u003c= 1.1.40 unauthenticated privilege escalation. When an admin denies the OttoKit SaaS connection, the plugin stores the fixed public string 'connection-denied' as the site API secret. The RestController::autheticate_user permission callback reads the 'st_authorization' request header, strips a 'Bearer ' prefix via sscanf($token,'Bearer %s'), then hash_equals() it against the stored secret. An attacker who sends 'st-authorization: Bearer connection-denied' is authenticated to the automation REST API and can create administrator accounts. Fixed in 1.1.41.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-110372.yaml"}
{"ID":"CVE-2026-110447","Info":{"Name":"Collabora Built-in CODE Server \u003c 26.4.303 - OS Command Injection","Severity":"critical","Description":"Collabora Online Built-in CODE Server before 26.4.303 contains a command injection caused by improper handling in proxy.php when the CODE server is not running, letting remote attackers execute OS commands, exploit requires CODE server to be stopped.\n","Classification":{"CVSSScore":"9.2"}},"file_path":"http/cves/2026/CVE-2026-110447.yaml"}
{"ID":"CVE-2026-1115","Info":{"Name":"parisneo/lollms \u003c 2.2.0 - Authenticated Stored XSS","Severity":"high","Description":"parisneo/lollms \u003c 2.2.0 contains a stored XSS caused by unsanitized user input in create_post function in backend/routers/social/__init__.py, letting attackers inject malicious scripts executed in user browsers, exploit requires crafted post submission.\n","Classification":{"CVSSScore":"9.0"}},"file_path":"http/cves/2026/CVE-2026-1115.yaml"}
{"ID":"CVE-2026-112866","Info":{"Name":"Product Filter by WBW \u003c= 3.4.6 - SQL Injection","Severity":"critical","Description":"WPFactory Product Filter by WBW woo-product-filter \u003c= 3.4.6 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-112866.yaml"}
{"ID":"CVE-2026-11387","Info":{"Name":"SMS Alert – SMS \u0026 OTP for WooCommerce - Privilege Escalation","Severity":"critical","Description":"The SMS Alert – SMS \u0026 OTP for WooCommerce, Order Notifications \u0026 Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.9.5. This is due to the plugin not properly validating a user's identity prior to updating their details like reset the password of any user account, including administrators, and gain full access to those accounts. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. This is only vulnerable on sites with OTP verification for password resets enabled, and where the administrator (or other user) has set a phone number for OTP verification.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-11387.yaml"}
{"ID":"CVE-2026-114509","Info":{"Name":"Laravel TokenGuard - Authentication Bypass","Severity":"critical","Description":"Laravel's TokenGuard (driver =\u003e token, hash =\u003e false) does not validate the\ncredential type before the database lookup. Sending a JSON body with\napi_token as an array of integers ({\"api_token\":[0]}) produces a\nwhereIn('api_token', [0]) query; under MySQL/MariaDB implicit casting,\nevery varchar token not starting with a digit evaluates to 0, so the first\nuser row is returned to an unauthenticated attacker.\n","Classification":{"CVSSScore":"9.2"}},"file_path":"http/cves/2026/CVE-2026-114509.yaml"}
{"ID":"CVE-2026-115574","Info":{"Name":"Zulip Server 11.0 - 12.1 - Unauthenticated Custom Profile Field Disclosure","Severity":"medium","Description":"Zulip 11.0 to 12.1 contains an information disclosure caused by missing access-control check in GET /json/users endpoint, letting unauthenticated spectators access all users' custom profile fields, exploit requires web-public channels enabled.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-115574.yaml"}
{"ID":"CVE-2026-11565","Info":{"Name":"WordPress Advanced File Manager \u003c 5.4.13 - Arbitrary File Read","Severity":"high","Description":"The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access (as low as Subscriber) to read arbitrary files on the server.\n","Classification":{"CVSSScore":"8.5"}},"file_path":"http/cves/2026/CVE-2026-11565.yaml"}
{"ID":"CVE-2026-115886","Info":{"Name":"MLflow \u003c3.17.0 - Unauthenticated SSRF via Third-Party (TruLens) Scorer","Severity":"medium","Description":"MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, the scorer invoke, register, and GenAI evaluate endpoints, including unauthenticated POST /ajax-api/3.0/mlflow/scorer/invoke, accept serialized third-party scorer data that Scorer.model_validate_json resolves using a module-path allowlist without constraining the selected class or its constructor arguments. When optional trulens and trulens-providers-litellm packages are installed, an attacker can select mlflow.genai.scorers.trulens, choose a model URI outside MLflow's native provider registry so execution uses the LiteLLM fallback, and supply api_base and api_key values that cause the server to send an outbound request to an attacker-chosen or internal host with attacker-controlled headers and body. The vulnerable deserialization occurs before a tracking-store lookup or job submission.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2026/CVE-2026-115886.yaml"}
{"ID":"CVE-2026-116006","Info":{"Name":"Ruoyi-Vue-Pro - Unauthenticated Admin Takeover via Predictable SMS Code","Severity":"critical","Description":"ruoyi-vue-pro (Yudao) ships base configuration yudao.sms-code.begin-code=end-code=9999, so every generated SMS verification code is the constant \"9999\" in all profiles. The anonymous SMS-login flow therefore grants an access token to any account whose mobile number is known: send-sms-code followed by sms-login with code 9999 issues a full token, including for the seeded super administrator account (mobile 18818260272 in the shipped SQL). No CAPTCHA hook exists for scene=21 in any profile.\n","Classification":{"CVSSScore":"9.2"}},"file_path":"http/cves/2026/CVE-2026-116006.yaml"}
{"ID":"CVE-2026-116067","Info":{"Name":"Paisa \u003c 0.7.8 - Unauthenticated Path Traversal","Severity":"high","Description":"Paisa \u003c 0.7.8 contains a path traversal vulnerability caused by improper sanitization of file names in GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers, letting unauthenticated attackers read arbitrary files and delete backups via ../ sequences.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-116067.yaml"}
{"ID":"CVE-2026-116070","Info":{"Name":"Docker-Proxy hubcmdui - Missing Authentication on /api/config","Severity":"medium","Description":"Docker-Proxy through 5.1.9 exposes the hubcmdui configuration endpoint /api/config without authentication. An unauthenticated remote attacker can read the full server configuration, including the WeChat/Telegram monitoring webhook URLs and bot token inside monitoringConfig, the menuItems structure and docker host settings, and can overwrite configuration via the unauthenticated POST handler. The fix restricts anonymous callers to a public subset (theme, language, logo, proxyDomain).\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2026/CVE-2026-116070.yaml"}
{"ID":"CVE-2026-116167","Info":{"Name":"SiYuan 2.9.0-3.8.6 - Unauthenticated XSS via check-auth \"to\" Parameter","Severity":"high","Description":"SiYuan 2.9.0 through 3.8.6 serves the unauthenticated /check-auth authorization page (app/stage/auth.html) with a script that assigns the `to` query parameter to window.location.href without scheme validation. A crafted link whose `to` value is a javascript: URI executes script in the kernel origin once the victim completes authentication on that page.\n","Classification":{"CVSSScore":"7.6"}},"file_path":"http/cves/2026/CVE-2026-116167.yaml"}
{"ID":"CVE-2026-116205","Info":{"Name":"YesWiki \u003c 4.7.0 - Unauthenticated Server-Side Request Forgery","Severity":"high","Description":"YesWiki \u003c 4.7.0 contains an unauthenticated server-side request forgery caused by improper handling of [[|URL]] wiki syntax in the render handler, letting remote attackers fetch arbitrary URLs, exploit requires no authentication.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-116205.yaml"}
{"ID":"CVE-2026-116366","Info":{"Name":"ClickHouse Server - Brotli v1.2.0 Decoder DoS/OOB-Write","Severity":"critical","Description":"ClickHouse Server contains a remote code execution vulnerability caused by improper access control, letting unauthenticated users with network access execute arbitrary code remotely, exploit requires network access.\n","Classification":{"CVSSScore":"9.5"}},"file_path":"http/cves/2026/CVE-2026-116366.yaml"}
{"ID":"CVE-2026-116485","Info":{"Name":"danmu_api - Unauthenticated Access to Admin API via Default Token","Severity":"high","Description":"danmu_api before 1.21.7 contains an authentication bypass caused by default TOKEN usage and unset ADMIN_TOKEN, letting unauthenticated attackers modify server environment configuration via specific API endpoints, exploit requires default token configuration.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-116485.yaml"}
{"ID":"CVE-2026-116548","Info":{"Name":"VikRentCar \u003c= 1.4.10 - Cross-Site Scripting","Severity":"high","Description":"The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'optionals' parameter in all versions up to, and including, 1.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2026/CVE-2026-116548.yaml"}
{"ID":"CVE-2026-116690","Info":{"Name":"MLflow 3.10.0-3.16.1 - Arbitrary File Read","Severity":"high","Description":"MLflow 3.10.0 through 3.16.1 contains a path traversal in the prompt branch of the CreateModelVersion handler. The fix for CVE-2026-2614 only validated prompt sources that carry a URL scheme, so a schemeless relative path such as ../../../etc is stored unchanged as the model version artifact location and later served by the model-versions/get-artifact endpoint, letting unauthenticated remote attackers read arbitrary files from the server filesystem.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-116690.yaml"}
{"ID":"CVE-2026-116748","Info":{"Name":"Transmission 4.0.0-4.1.2 - Permissive CORS Exposes RPC Session ID","Severity":"medium","Description":"Transmission 4.0.0 through 4.1.2 sends Access-Control-Allow-Origin: * on RPC responses and advertises X-Transmission-Session-Id via Access-Control-Expose-Headers on the 409 session handshake. Any website a user visits can read the session-id nonce that guards against CSRF, enabling cross-origin control of the daemon's RPC API.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-116748.yaml"}
{"ID":"CVE-2026-116817","Info":{"Name":"OpenPanel - Unauthenticated Bull Board Queue Dashboard","Severity":"medium","Description":"OpenPanel before 3.0.0 contains a broken authentication vulnerability caused by missing authentication on the Bull Board dashboard served on the worker HTTP port, letting unauthenticated attackers access and modify queue data and jobs, exploit requires no authentication.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2026/CVE-2026-116817.yaml"}
{"ID":"CVE-2026-11801","Info":{"Name":"WPAdverts \u003c= 2.3.2 - Information Disclosure","Severity":"high","Description":"WPAdverts – Classifieds Plugin for WordPress \u003c= 2.3.2 contains an authorization bypass caused by improper user authorization verification in classifieds-types REST endpoint, letting unauthenticated attackers retrieve internal site configuration data, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-11801.yaml"}
{"ID":"CVE-2026-118523","Info":{"Name":"EventPrime \u003c 4.3.6.1 - Unauthenticated Pending Post Disclosure","Severity":"medium","Description":"EventPrime WordPress plugin \u003c 4.3.6.1 contains a broken access control vulnerability caused by improper handling of Pending Review post status, letting unauthenticated users view non-public content awaiting review, exploit requires no authentication.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-118523.yaml"}
{"ID":"CVE-2026-118539","Info":{"Name":"Drupal Commerce Core \u003c 3.3.13 / \u003c 8.x-2.41 - Guest Cart Admin Access Bypass","Severity":"critical","Description":"Drupal Commerce Core before 3.3.13 on the 3.x branch and before 8.x-2.41\non the 2.x branch does not sufficiently protect certain order administration\nroutes. This template finds a public product using a bounded set of 63\ncanonical product IDs, adds one item to a fresh guest cart, and checks\nwhether the guest can read that cart order's administrative state-transition\nform. No account, prior order ID, JSON:API, or checkout is required. The\nguest draft order persists. Sites without a usable product among the sampled\nIDs produce no finding, which is inconclusive.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-118539.yaml"}
{"ID":"CVE-2026-119495","Info":{"Name":"WordPress Better Search \u003c 4.5.3 - Unauthenticated Arbitrary Post Type Content Disclosure","Severity":"medium","Description":"WebberZone Better Search \u003c= 4.5.2 contains a broken access control caused by incorrectly configured access control security levels, letting attackers exploit unauthorized access, exploit requires no special privileges.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-119495.yaml"}
{"ID":"CVE-2026-120201","Info":{"Name":"Jpom 2.10.0-2.11.12 - Authentication Bypass","Severity":"critical","Description":"Jpom 2.10.0 through 2.11.12 contains an authentication bypass caused by injection of query conditions into the JPOM-USER-TOKEN header, letting unauthenticated attackers gain super-administrator access and execute commands, exploit requires crafted header injection.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-120201.yaml"}
{"ID":"CVE-2026-120442","Info":{"Name":"ape-volo-admin \u003c= 3.5.2 - Authentication Bypass via Hardcoded JWT Signing Key","Severity":"critical","Description":"ape-volo-admin \u003c 3.6.1 contains an authentication bypass caused by a hardcoded JWT signing key in appsettings.json, letting unauthenticated attackers forge administrator tokens and gain full API control, exploit requires knowledge of the hardcoded key.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-120442.yaml"}
{"ID":"CVE-2026-120446","Info":{"Name":"madong-admin-saas \u003c= 5.1.4 - Unauthenticated Platform Tenant Management Access","Severity":"high","Description":"madong-admin-saas \u003c= 5.1.4 contains a broken authentication caused by 'platformapi' middleware key mismatch in platform tenant management API, letting unauthenticated remote attackers manage tenants and subscription plans.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-120446.yaml"}
{"ID":"CVE-2026-120597","Info":{"Name":"WordPress Welcart e-Commerce \u003c 2.12.7 - Cross-Site Scripting","Severity":"medium","Description":"Welcart e-Commerce Plugin up to 2.12.6 contains a stored XSS caused by improper escaping of the ResponseCd argument in ESCOTT_MAIN::error_page_message, letting remote attackers execute scripts, exploit requires crafted input.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2026/CVE-2026-120597.yaml"}
{"ID":"CVE-2026-1207","Info":{"Name":"Django RasterField - SQL Injection","Severity":"high","Description":"Django \u003c 6.0.2, \u003c 5.2.11, and \u003c 4.2.28 contains a SQL injection caused by improper sanitization of the band index parameter in RasterField on PostGIS, letting remote attackers inject SQL, exploit requires crafted input.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2026/CVE-2026-1207.yaml"}
{"ID":"CVE-2026-12227","Info":{"Name":"Visual Composer \u003c= 45.16.0 - Unauthenticated LFI","Severity":"critical","Description":"Visual Composer Website Builder for WordPress \u003c= 45.16.0 contains a local file inclusion vulnerability caused by improper validation of the vcv-template parameter, letting unauthenticated attackers include and execute arbitrary files, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-12227.yaml"}
{"ID":"CVE-2026-12394","Info":{"Name":"WordPress MemberGlut \u003c 1.1.5 - Unauthenticated Privilege Escalation","Severity":"critical","Description":"MemberGlut WordPress plugin \u003c 1.1.5 contains a broken access control vulnerability caused by lack of validation of roles during front-end registration, letting unauthenticated users register with arbitrary roles including administrator, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-12394.yaml"}
{"ID":"CVE-2026-12583","Info":{"Name":"Newsletters \u003c 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field","Severity":"high","Description":"The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, write arbitrary files and execute code on the server.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2026/CVE-2026-12583.yaml"}
{"ID":"CVE-2026-12609","Info":{"Name":"Eclipse Theia - Unauthenticated Path Traversal","Severity":"high","Description":"Eclipse Theia's plugin-ext backend exposes the hostedPlugin endpoint without constraining the resolved path to the plugin directory. An unauthenticated request using encoded traversal sequences can therefore read files accessible to the backend process. The built-in vscode_bat plugin identifier provides a deterministic anchor without target-specific setup.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-12609.yaml"}
{"ID":"CVE-2026-12741","Info":{"Name":"WP Fast Total Search \u003c= 1.80.280 - Unauthenticated Time-Based Blind SQL Injection","Severity":"high","Description":"WP Fast Total Search (fulltext-search) versions up to and including 1.80.280 contain an unauthenticated time-based blind SQL injection. The wp_ajax_nopriv_wpfts_autocomplete handler reads the form_data[s] parameter and feeds it into a WP_Query. The plugin's index_sql_where() builds its cluster query with double-quoted string literals using esc_like() which only escapes LIKE wildcards and not quotes, allowing a double quote to break out of the literal. When form_data[sentence] is set, the search term is used verbatim, giving a clean injection point.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-12741.yaml"}
{"ID":"CVE-2026-1277","Info":{"Name":"URL Shortify \u003c= 1.12.1 - Open Redirect","Severity":"medium","Description":"The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirect_to' parameter in the promotional dismissal handler. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites via a crafted link.\n","Classification":{"CVSSScore":"4.7"}},"file_path":"http/cves/2026/CVE-2026-1277.yaml"}
{"ID":"CVE-2026-12800","Info":{"Name":"Premium Packages – Sell Digital Products Securely - SQL Injection","Severity":"high","Description":"Premium Packages – Sell Digital Products Securely WordPress plugin \u003c= 6.2.0 contains a SQL injection caused by insufficient escaping of 'code' parameter in CouponCodes::find() method, letting unauthenticated attackers extract sensitive database information via crafted SQL queries.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-12800.yaml"}
{"ID":"CVE-2026-1281","Info":{"Name":"Ivanti EPMM \u003c=12.7.0.0 - Unauthenticated Code Injection","Severity":"critical","Description":"Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.0 through 12.7.0.0 contain a code injection vulnerability that allows unauthenticated remote attackers to achieve arbitrary code execution on the target system.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-1281.yaml"}
{"ID":"CVE-2026-12898","Info":{"Name":"All-in-One WP Migration and Backup \u003c 7.106 - Arbitrary Log File Write","Severity":"medium","Description":"The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path. This makes it possible for unauthenticated attackers to create or append a log file in arbitrary locations outside the intended storage directory.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2026/CVE-2026-12898.yaml"}
{"ID":"CVE-2026-1296","Info":{"Name":"Frontend Post Submission Manager Lite \u003c= 1.2.7 - Open Redirect","Severity":"medium","Description":"The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficient validation on the 'requested_page' POST parameter in the verify_username_password function. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action such as clicking on a link.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-1296.yaml"}
{"ID":"CVE-2026-12970","Info":{"Name":"WordPress LearnPress \u003c 4.4.1 - Cross-Site Scripting","Severity":"high","Description":"LearnPress \u003c 4.4.1 does not escape the c_search parameter before reflecting it into the value attribute of the search input on the Course Builder questions page (/course-builder/questions/), allowing attribute-injection reflected XSS against authenticated admins/instructors.\n","Classification":{"CVSSScore":"7.1"}},"file_path":"http/cves/2026/CVE-2026-12970.yaml"}
{"ID":"CVE-2026-13001","Info":{"Name":"Podlove Podcast Publisher \u003c= 4.5.1 - Arbitrary File Upload","Severity":"critical","Description":"Podlove Podcast Publisher plugin for WordPress through 4.5.1 is vulnerable to arbitrary file uploads due to missing file type validation in the podlove_handle_cache_files function. The image cache derives the stored file extension from the path of the attacker supplied source URL, while the image validation is performed against a different file name taken from the full source URL, so a source URL whose path carries a dangerous extension is written to the cache with that extension.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-13001.yaml"}
{"ID":"CVE-2026-1306","Info":{"Name":"WordPress midi-Synth \u003c= 1.1.0 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"WordPress midi-Synth plugin \\u003C= 1.1.0 contains an unrestricted file upload vulnerability caused by missing file type and extension validation in the 'export' AJAX action, letting unauthenticated attackers upload arbitrary files and potentially execute remote code, exploit requires attacker to obtain a valid nonce exposed in frontend JavaScript.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-1306.yaml"}
{"ID":"CVE-2026-1314","Info":{"Name":"WordPress 3D FlipBook \u003c= 1.16.17 - Information Disclosure","Severity":"medium","Description":"WordPress 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery plugin versions \u003c= 1.16.17 contain a missing authorization vulnerability in multiple AJAX endpoints. The fb3d_send_posts_in, fb3d_send_post_pages, fb3d_send_posts_in_pages, fb3d_send_posts_in_first_page, and fb3d_send_post_first_page handlers are registered with wp_ajax_nopriv hooks but fail to verify the post status of requested flipbook entries. This allows unauthenticated attackers to retrieve full metadata, PDF URLs, and configuration data of private, draft, and password-protected flipbook posts.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-1314.yaml"}
{"ID":"CVE-2026-13147","Info":{"Name":"WordPress Kirki \u003c 6.0.12 - Server-Side Request Forgery","Severity":"high","Description":"Kirki WordPress plugin \u003c 6.0.12 contains a server-side request forgery caused by lack of URL validation, letting unauthenticated attackers make the site issue HTTP requests to arbitrary hosts, exploit requires no authentication.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-13147.yaml"}
{"ID":"CVE-2026-13153","Info":{"Name":"Essential Blocks \u003c 6.4.0 - Information Disclosure","Severity":"medium","Description":"Gutenberg Essential Blocks WordPress plugin \u003c 6.4.0 contains an information disclosure caused by unrestricted access to a public REST route exposing non-public WooCommerce sales metrics, letting unauthenticated users read product sales data.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-13153.yaml"}
{"ID":"CVE-2026-1340","Info":{"Name":"Ivanti EPMM \u003c 12.8.0.0 - Remote Code Execution","Severity":"critical","Description":"Ivanti Endpoint Manager Mobile contains a code injection vulnerability allowing unauthenticated attackers to execute arbitrary code remotely, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-1340.yaml"}
{"ID":"CVE-2026-1357","Info":{"Name":"WPvivid Backup \u0026 Migration \u003c= 0.9.123 - Arbitrary File Upload","Severity":"critical","Description":"WPvivid Backup \u0026 Migration plugin for WordPress \u003c= 0.9.123 contains an unauthenticated arbitrary file upload vulnerability caused by improper error handling in RSA decryption and lack of path sanitization, letting unauthenticated attackers upload arbitrary PHP files and achieve remote code execution via wpvivid_action=send_to_site parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-1357.yaml"}
{"ID":"CVE-2026-1368","Info":{"Name":"Video Conferencing with Zoom API \u003c 4.6.6 - Unauthenticated SDK Signature Generation","Severity":"high","Description":"Zoom WordPress plugin \u003c 4.6.6 contains a broken authentication caused by disabled nonce verification in an AJAX handler, letting unauthenticated attackers generate valid Zoom SDK signatures and retrieve the Zoom SDK key.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-1368.yaml"}
{"ID":"CVE-2026-13731","Info":{"Name":"WPBot \u003c= 8.4.9 - Cross-Site Scripting","Severity":"high","Description":"WPBot \u003c= 8.4.9 is vulnerable to stored cross-site scripting via the conversation parameter in the qcld_wb_chatbot_conversation_save AJAX action. The AJAX nonce (qcsecretbotnonceval123qc) is publicly emitted on every frontend page via wp_localize_script under the ajax_nonce key, making it freely obtainable by unauthenticated visitors. The conversation parameter is saved to the database without sanitization and rendered unsanitized in the admin chat session view, causing stored XSS that executes when an administrator views saved chat sessions.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2026/CVE-2026-13731.yaml"}
{"ID":"CVE-2026-1405","Info":{"Name":"WordPress Slider Future \u003c= 1.0.5 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"Slider Future WordPress plugin \u003c= 1.0.5 contains an unrestricted file upload vulnerability caused by missing file type validation in 'slider_future_handle_image_upload', letting unauthenticated attackers upload arbitrary files, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-1405.yaml"}
{"ID":"CVE-2026-14483","Info":{"Name":"Realtyna Organic IDX/WPL \u003c= 5.2.0 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress \u003c= 5.2.0 contains an unrestricted file upload vulnerability caused by missing file type validation and static API credentials, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit requires knowledge of static API credentials.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-14483.yaml"}
{"ID":"CVE-2026-14554","Info":{"Name":"WordPress Check \u0026 Log Email \u003c 2.0.15 - SQL Injection","Severity":"medium","Description":"The Check \u0026 Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2026/CVE-2026-14554.yaml"}
{"ID":"CVE-2026-14870","Info":{"Name":"WordPress Database for Contact Form 7, WPforms, Elementor forms \u003c 1.5.3 - Cross-Site Scripting","Severity":"high","Description":"Database for Contact Form 7, WPforms, Elementor forms WordPress plugin \u003c 1.5.3 contains a reflected XSS caused by improper sanitization and escaping of a parameter in an admin page, letting attackers execute scripts against admin users, exploit requires admin access.\n","Classification":{"CVSSScore":"7.1"}},"file_path":"http/cves/2026/CVE-2026-14870.yaml"}
{"ID":"CVE-2026-14894","Info":{"Name":"WordPress Super Forms \u003c= 6.3.313 - Arbitrary File Upload","Severity":"critical","Description":"Super Forms – Drag \u0026 Drop Form Builder WordPress plugin \\u003C= 6.3.313 contains an arbitrary file upload vulnerability caused by missing file type validation and lack of capability checks in submit_form nopriv AJAX handler, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit requires no authentication due to nonce bypass.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-14894.yaml"}
{"ID":"CVE-2026-1492","Info":{"Name":"WordPress User Registration \u0026 Membership \u003c= 5.1.2 - Unauthenticated Privilege Escalation","Severity":"critical","Description":"User Registration \u0026 Membership WordPress plugin \u003c= 5.1.2 contains an improper privilege management vulnerability caused by accepting user-supplied roles without server-side allowlist enforcement, letting unauthenticated attackers create administrator accounts\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-1492.yaml"}
{"ID":"CVE-2026-15015","Info":{"Name":"MountDev AI MCP Connector \u003c= 1.6.1 - Unauthenticated Admin OAuth Token Exposure","Severity":"critical","Description":"MountDev AI MCP Connector for WordPress (mountdev-ai-mcp-connector) \u003c= 1.6.1 is vulnerable to unauthenticated authorization bypass (CWE-862) via its OAuth 2.0 implementation. The plugin exposes a publicly accessible Dynamic Client Registration endpoint (/mcp-register) at WordPress init-level that allows any unauthenticated caller to register arbitrary OAuth clients. The subsequent authorization endpoint (/wp-json/mountdev-ai-mcp-connector/v1/oauth/authorize) then auto-approves the OAuth flow using the first WordPress administrator account found via get_users({role: administrator, number: 1}), issuing an admin-bound authorization code without checking who is making the request. Exchanging this code at /mcp-token yields a full Bearer token granting administrator-equivalent access to the MCP tool surface and all exposed WordPress content, users, options, and settings.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-15015.yaml"}
{"ID":"CVE-2026-15094","Info":{"Name":"WP Hotel Booking \u003c= 2.3.2 - Cross-Site Scripting","Severity":"medium","Description":"The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-15094.yaml"}
{"ID":"CVE-2026-1557","Info":{"Name":"WP Responsive Images \u003c= 1.0 - Arbitrary File Read","Severity":"high","Description":"WP Responsive Images plugin for WordPress \u003c= 1.0 contains a path traversal caused by improper sanitization of the 'src' parameter, letting unauthenticated attackers read arbitrary files on the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-1557.yaml"}
{"ID":"CVE-2026-15733","Info":{"Name":"WGDashboard \u003c= 4.3.2 - Authenticated OS Command Injection /etc/passwd Read","Severity":"critical","Description":"WGDashboard \u003c= 4.2.3 contains a command injection caused by multiple OS command injection points, letting authenticated attackers execute arbitrary commands as root.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-15733.yaml"}
{"ID":"CVE-2026-1581","Info":{"Name":"wpForo Forum \u003c= 2.4.14 - SQL Injection","Severity":"critical","Description":"wpForo Forum WordPress plugin \u003c= 2.4.14 contains a time-based SQL injection caused by insufficient escaping of the 'wpfob' parameter, letting unauthenticated attackers extract sensitive database information.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-1581.yaml"}
{"ID":"CVE-2026-15826","Info":{"Name":"User Profile Builder 3.16.4 - Unauthenticated Authentication Bypass","Severity":"critical","Description":"The User Profile Builder plugin for WordPress version 3.16.4 is vulnerable to an authentication bypass via type confusion. Profile Builder's automatic-login-after-registration handler passes the return value of wp_insert_user() through absint() before testing it with is_wp_error(), so the error check runs against the already-coerced integer. A registration submitted with a 61-70 character username passes the plugin's own validation but is rejected by WordPress core, because the user_login column is VARCHAR(60), and wp_insert_user() returns a WP_Error object. absint() coerces that object to the integer 1, is_wp_error(1) is false, and the plugin binds a transient-backed autologin nonce to user ID 1. Consuming that nonce calls wp_set_auth_cookie(1) and logs the unauthenticated attacker in as the site's Administrator.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-15826.yaml"}
{"ID":"CVE-2026-1603","Info":{"Name":"Ivanti Endpoint Manager - Authentication Bypass","Severity":"high","Description":"Ivanti Endpoint Manager \u003c 2024 SU5 contains an authentication bypass caused by improper access control, letting remote unauthenticated attackers leak stored credential data, exploit requires no special privileges.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2026/CVE-2026-1603.yaml"}
{"ID":"CVE-2026-16268","Info":{"Name":"Newsletters \u003c 4.16 - Unauthenticated SSRF via SNS Bounce Handler","Severity":"medium","Description":"Newsletters WordPress plugin \u003c 4.16 contains a server-side request forgery caused by lack of authentication and validation in bounce-processing requests, letting unauthenticated attackers make arbitrary requests to internal or external hosts.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-16268.yaml"}
{"ID":"CVE-2026-16535","Info":{"Name":"WordPress Link Library \u003c 7.9.4 - Cross-Site Scripting","Severity":"medium","Description":"Link Library WordPress plugin \u003c 7.9.4 contains a reflected XSS caused by unsanitised and unescaped parameter reflected in response, letting unauthenticated attackers execute scripts via user interaction.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-16535.yaml"}
{"ID":"CVE-2026-16959","Info":{"Name":"WordPress Media Library Assistant \u003c 3.40 - SQL Injection","Severity":"medium","Description":"The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role and above to perform SQL injection.\n","Classification":{"CVSSScore":"6.8"}},"file_path":"http/cves/2026/CVE-2026-16959.yaml"}
{"ID":"CVE-2026-17505","Info":{"Name":"WordPress TranslatePress \u003c 3.2.6 - Cross-Site Scripting","Severity":"medium","Description":"TranslatePress plugin \u003c 3.2.6 for WordPress contains a reflected cross-site scripting vulnerability in the translation marker processing feature, letting attackers inject and execute arbitrary JavaScript code, exploit requires no authentication or privileges.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-17505.yaml"}
{"ID":"CVE-2026-17532","Info":{"Name":"Seraphinite Accelerator \u003c= 2.29.18 - Cross-Site Scripting","Severity":"medium","Description":"The Seraphinite Accelerator plugin for WordPress up to and including 2.29.18 was vulnerable to reflected cross-site scripting through the seraph_accel_prep parameter. CacheExtractPreparePageParams() compared the expected HMAC against the JSON-decoded nonce with PHP's loose != operator, so a JSON boolean true satisfied the comparison and bypassed the signature check, and _CbContentFinishSkip() then concatenated the attacker-controlled selfTest field straight into the response body, letting unauthenticated attackers inject arbitrary scripts.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-17532.yaml"}
{"ID":"CVE-2026-17540","Info":{"Name":"WordPress Bit File Manager \u003c 6.9.1 - Arbitrary File Read","Severity":"high","Description":"The Bit File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-17540.yaml"}
{"ID":"CVE-2026-17594","Info":{"Name":"Sonatype Nexus Repository \u003c 3.95.0 - Privilege Escalation via Repository Format Mismatch","Severity":"high","Description":"Nexus Repository 3 CE/Pro 3.0.0 through 3.94.x contains an incorrect authorization vulnerability caused by inconsistent authorization checks in the repository-creation UI, letting delegated repository-admin users create unauthorized repository formats, exploit requires delegated repository-admin privilege.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2026/CVE-2026-17594.yaml"}
{"ID":"CVE-2026-18051","Info":{"Name":"W3 Total Cache \u003c 2.10.5 - Unauthenticated Arbitrary Directory File Write","Severity":"critical","Description":"W3 Total Cache WordPress plugin \u003c 2.10.5 contains an unrestricted file write vulnerability caused by improper validation of request paths used for cache file names, letting unauthenticated attackers overwrite files including .htaccess, exploit requires no authentication.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-18051.yaml"}
{"ID":"CVE-2026-18072","Info":{"Name":"Advanced Responsive Video Embedder 10.8.7/10.8.8 - Hardcoded Backdoor Authentication Bypass","Severity":"critical","Description":"The compromised Advanced Responsive Video Embedder WordPress plugin releases 10.8.7 and 10.8.8 accept a hardcoded token through the `_wplogin` parameter and establish an authenticated administrator session before normal authentication. A single unauthenticated GET request triggers the backdoor. This template only inspects the redirect and session-cookie response and does not perform any administrative action.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-18072.yaml"}
{"ID":"CVE-2026-18110","Info":{"Name":"Concrete CMS - User Enumeration","Severity":"high","Description":"Concrete CMS versions 9.0.0 through 9.5.2 are vulnerable to unauthenticated user enumeration via a missing authorization check in the \"Preview As User\" panel (concrete/controllers/panel/page/preview_as_user.php).\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-18110.yaml"}
{"ID":"CVE-2026-18143","Info":{"Name":"Request Quote for WooCommerce \u003c= 2.9.2 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"Request a Quote for WooCommerce plugin for WordPress \u003c= 2.9.2 contains an unrestricted file upload vulnerability caused by missing file extension and MIME type validation in afrfq_submit_quote_via_popup(), letting unauthenticated attackers upload executable files, exploit requires enabled public quote rule with multi-page popup flow.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-18143.yaml"}
{"ID":"CVE-2026-1830","Info":{"Name":"Quick Playground \u003c= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"The Quick Playground plugin for WordPress is vulnerable to remote code execution in all versions up to, and including, 1.3.1.\nThe plugin exposes a blueprint REST API endpoint (permission_callback: __return_true) that leaks the sync code, and an upload_image endpoint that accepts file uploads with path traversal in the filename parameter without sufficient authorization checks, which can be chained into arbitrary PHP file upload and RCE.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-1830.yaml"}
{"ID":"CVE-2026-18315","Info":{"Name":"TrueBooker \u003c= 1.2.6 - Unauthenticated Authorization Bypass","Severity":"critical","Description":"TrueBooker – Appointment Booking and Scheduler System WordPress plugin \u003c= 1.2.6 contains an authorization bypass through user-controlled key caused by lack of authentication in admin_user_create_cus AJAX handler, letting unauthenticated attackers take over any user account by overwriting email and using lost-password flow, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-18315.yaml"}
{"ID":"CVE-2026-18577","Info":{"Name":"N-able N-central \u003c 2026.3.1.10 - Authentication Bypass","Severity":"critical","Description":"N-able N-central versions through 2026.3.1 contain an authentication bypass that lets a remote unauthenticated attacker take over an administrator account and gain full control of the N-central server. CVE-2026-18577 is a bypass of the incomplete fix for CVE-2026-18556, so the 2026.3.1 Hotfix 1 build (2026.3.1.7) does not fully remediate it. Hotfix 2 (2026.3.1.10) supersedes Hotfix 1 and is the first fully fixed 2026.3 build.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2026/CVE-2026-18577.yaml"}
{"ID":"CVE-2026-1890","Info":{"Name":"LeadConnector \u003c 3.0.22 - Unauthenticated Arbitrary Data Write","Severity":"medium","Description":"LeadConnector WordPress plugin \u003c 3.0.22 contains a broken access control caused by missing authorization in a REST route, letting unauthenticated attackers overwrite existing data remotely, exploit requires no authentication.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-1890.yaml"}
{"ID":"CVE-2026-18937","Info":{"Name":"WordPress Broken Link Checker \u003c 2.4.12 - Remote Code Execution","Severity":"critical","Description":"The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables on the server when a classic (non-block) theme is active.\n","Classification":{"CVSSScore":"9.0"}},"file_path":"http/cves/2026/CVE-2026-18937.yaml"}
{"ID":"CVE-2026-18963","Info":{"Name":"Keycloak \u003c 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass","Severity":"critical","Description":"Keycloak versions prior to 26.7.2, 26.6.6, and 26.4.15 contain a flaw in the reset-credentials flow that allows an unauthenticated attacker to bypass email verification and take over any user account. Two bugs are chained: (1) the tryAnotherWay handler stores a generic \"true\" selector note not scoped to the execution ID, and (2) ResetCredentialEmail.action() calls context.success() without verifying ACTION_TOKEN_USER_ID.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-18963.yaml"}
{"ID":"CVE-2026-19089","Info":{"Name":"Product Input Fields for WooCommerce \u003c 2.0.2 - Arbitrary File Upload to RCE","Severity":"critical","Description":"WooCommerce WordPress plugin \u003c 2.0.2 contains an unrestricted file upload vulnerability caused by lack of validation on uploaded file types when accepted-types setting is empty, letting unauthenticated attackers upload arbitrary files and achieve remote code execution on servers ignoring directory access rules, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-19089.yaml"}
{"ID":"CVE-2026-19092","Info":{"Name":"Tutor LMS \u003c 4.0.6 - Unauthenticated Arbitrary PHP Function Invocation","Severity":"critical","Description":"Tutor LMS WordPress plugin \u003c 4.0.6 contains a template injection caused by insufficient prevention of request data overwriting internal variables during template rendering, letting unauthenticated attackers invoke arbitrary zero-argument PHP functions and receive their output.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-19092.yaml"}
{"ID":"CVE-2026-19478","Info":{"Name":"GitLab CE/EE - GraphQL @gl_introduced Arbitrary Method Invocation","Severity":"critical","Description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.\n","Classification":{"CVSSScore":"9.4"}},"file_path":"http/cves/2026/CVE-2026-19478.yaml"}
{"ID":"CVE-2026-19598","Info":{"Name":"Pods \u003c= 3.3.9 - Unauthenticated Privilege Escalation via pods_admin AJAX Router","Severity":"critical","Description":"The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the pods_admin AJAX router funnels every access check — including the method allowlist, nonce verification, login enforcement, and capability gate — through pods_error(), which under the JSON meta-box-loader compatibility path only writes failures to the PHP error log and returns false instead of terminating the request, rendering all guards ineffective. This makes it possible for unauthenticated attackers to escalate their privileges to Administrator or overwrite the password of any user account, including the site owner's, enabling complete site takeover, or perform another administrator action.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-19598.yaml"}
{"ID":"CVE-2026-19632","Info":{"Name":"TranslatePress \u003c= 3.3.1 - Unauthenticated Account Takeover","Severity":"critical","Description":"TranslatePress WordPress plugin \u003c= 3.3.1 contains a sensitive information exposure caused by the 'trp_get_translations_regular' AJAX action saving password-reset URLs in translation dictionary, letting unauthenticated attackers extract admin password-reset URLs, exploit requires automatic string saving enabled and admin profile locale set to a published secondary language.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-19632.yaml"}
{"ID":"CVE-2026-1980","Info":{"Name":"WPBookit \u003c= 1.0.8 - Unauthenticated Customer Information Disclosure","Severity":"medium","Description":"WPBookit WordPress plugin \u003c= 1.0.8 contains an information disclosure vulnerability caused by missing authorization check on 'get_customer_list' route, letting unauthenticated attackers retrieve sensitive customer data.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-1980.yaml"}
{"ID":"CVE-2026-19900","Info":{"Name":"LB-LINK Routers - Unauthenticated Command Injection","Severity":"critical","Description":"LB-LINK X-PRO 1.0.22-20231206 contains a hardcoded credentials vulnerability caused by manipulation of an unknown function in /etc/shadow, letting remote attackers use hardcoded credentials, exploit requires high complexity\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-19900.yaml"}
{"ID":"CVE-2026-20079","Info":{"Name":"Cisco Secure Firewall Management Center - Authentication Bypass","Severity":"critical","Description":"Cisco Secure Firewall Management Center Software contains an authentication bypass caused by improper system process creation at boot, letting unauthenticated remote attackers execute scripts and gain root access, exploit requires crafted HTTP requests.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2026/CVE-2026-20079.yaml"}
{"ID":"CVE-2026-2025","Info":{"Name":"Mail Mint \u003c 1.19.5 - Unauthenticated Email Disclosure","Severity":"high","Description":"Mail Mint WordPress plugin \u003c 1.19.5 contains an information disclosure vulnerability caused by lack of authorization in a REST API endpoint, letting unauthenticated users retrieve email addresses of blog users, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-2025.yaml"}
{"ID":"CVE-2026-20253","Info":{"Name":"Splunk Enterprise \u0026 Cloud Platform - Unrestricted File Upload","Severity":"critical","Description":"In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.3 and 10.2.2510.14, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.\u003cbr\u003e\u003cbr\u003eThe vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any network-reachable user to invoke file operations without credentials.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-20253.yaml"}
{"ID":"CVE-2026-20896","Info":{"Name":"Gitea Docker Image \u003c= 1.26.2 - Reverse Proxy Header Authentication Bypass","Severity":"critical","Description":"The official Gitea Docker image through version 1.26.2 ships with REVERSE_PROXY_TRUSTED_PROXIES set to a wildcard, causing Gitea to trust reverse-proxy authentication headers (X-WEBAUTH-USER) from any source IP instead of restricting trust to the configured reverse proxy. When reverse-proxy authentication is enabled, an unauthenticated remote attacker can impersonate any existing user, including an administrator, by sending the target username in the X-WEBAUTH-USER header.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-20896.yaml"}
{"ID":"CVE-2026-2113","Info":{"Name":"tpadmin \u003c= 1.3.12 - Remote Code Execution","Severity":"critical","Description":"yuan1994 tpadmin up to version 1.3.12 is vulnerable to Remote Code Execution via unrestricted file upload in the WebUploader preview component (/public/static/admin/lib/webuploader/0.1.5/server/preview.php). An unauthenticated remote attacker can submit base64-encoded PHP payloads leading to arbitrary code execution with web server privileges.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-2113.yaml"}
{"ID":"CVE-2026-21445","Info":{"Name":"Langflow - Broken Access Control","Severity":"critical","Description":"Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-21445.yaml"}
{"ID":"CVE-2026-21484","Info":{"Name":"AnythingLLM - Username Enumeration via Password Recovery","Severity":"medium","Description":"AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to commit e287fab56089cf8fcea9ba579a3ecdeca0daa313, the password recovery endpoint returns different error messages depending on whether a username exists, so enabling username enumeration. Commit e287fab56089cf8fcea9ba579a3ecdeca0daa313 fixes this issue.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-21484.yaml"}
{"ID":"CVE-2026-21589","Info":{"Name":"Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read","Severity":"critical","Description":"Atlassian products including Jira, Confluence, and Bitbucket Data Center contain a pre-authentication arbitrary file read vulnerability in the shared atlassian-plugins-webresource library. The library improperly handles double colons (::) as path separators in the resource routing, allowing unauthenticated attackers to traverse the filesystem and read arbitrary files within the application server's webroot, including sensitive configuration files such as web.xml and crowd.properties containing plaintext credentials.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-21589.yaml"}
{"ID":"CVE-2026-21643","Info":{"Name":"Fortinet FortiClientEMS 7.4.4 - SQL Injection","Severity":"critical","Description":"Fortinet FortiClientEMS version 7.4.4 and earlier contains an unauthenticated SQL injection vulnerability in the /api/v1/init_consts endpoint. The 'Site' HTTP header value is passed directly into the PostgreSQL search_path without sanitization, allowing remote unauthenticated attackers to inject arbitrary SQL commands. This can lead to information disclosure, database manipulation, or OS command execution when chained with PostgreSQL functions.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-21643.yaml"}
{"ID":"CVE-2026-21858","Info":{"Name":"n8n Webhooks - Remote Code Execution","Severity":"critical","Description":"n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker, resulting in exposure of sensitive information stored on the system and may enable further compromise depending on deployment configuration and workflow usage. This issue is fixed in version 1.121.0.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-21858.yaml"}
{"ID":"CVE-2026-21859","Info":{"Name":"Mailpit \u003c 1.28.3 - Server-Side Request Forgery","Severity":"high","Description":"Mailpit \u003c= 1.28.0 contains a server-side request forgery caused by insufficient validation of internal IP addresses in the /proxy endpoint, letting attackers make requests to internal network resources, exploit requires crafted HTTP GET requests.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2026/CVE-2026-21859.yaml"}
{"ID":"CVE-2026-21875","Info":{"Name":"ClipBucket v5 \u003c= 5.5.2 - Unauthenticated Blind SQL Injection","Severity":"critical","Description":"ClipBucket v5.5.2-#187 and below contain a blind SQL injection caused by unsanitized obj_id parameter in /actions/ajax.php used in user_exists function, letting attackers perform blind SQL injection remotely, exploit requires crafted POST request.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-21875.yaml"}
{"ID":"CVE-2026-21877","Info":{"Name":"n8n \u003e= 0.123.0 and \u003c 1.121.3 - Remote Code Execution","Severity":"critical","Description":"n8n versions \u003e= 0.123.0 and \u003c 1.121.3 contain a critical authenticated remote code execution vulnerability via arbitrary file write. An authenticated user can exploit the Git node to overwrite critical files and execute untrusted code on the n8n server, potentially leading to full system compromise. The vulnerability affects both self-hosted and n8n Cloud instances.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2026/CVE-2026-21877.yaml"}
{"ID":"CVE-2026-21891","Info":{"Name":"ZimaOS - Authentication Bypass","Severity":"critical","Description":"ZimaOS \u003c= 1.5.0 contains a broken authentication caused by improper password validation for known system service accounts in the login function, letting attackers authenticate with any password for these accounts, exploit requires knowledge of common usernames.\n","Classification":{"CVSSScore":"9.4"}},"file_path":"http/cves/2026/CVE-2026-21891.yaml"}
{"ID":"CVE-2026-22200","Info":{"Name":"osTicket - Arbitrary File Read","Severity":"high","Description":"Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficiently sanitized before being processed by the mPDF PDF generator during export. When the attacker exports the ticket to PDF, the generated PDF can embed the contents of attacker-selected files from the server filesystem as bitmap images, allowing disclosure of sensitive local files in the context of the osTicket application user. This issue is exploitable in default configurations where guests may create tickets and access ticket status, or where self-registration is enabled.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-22200.yaml"}
@@ -3966,12 +4081,16 @@
{"ID":"CVE-2026-2262","Info":{"Name":"Easy Appointments \u003c= 3.12.21 - Information Disclosure","Severity":"high","Description":"Easy Appointments WordPress plugin \u003c= 3.12.21 contains a sensitive information exposure caused by an unauthenticated REST API endpoint /wp-json/wp/v2/eablocks/ea_appointments/ registered with permission_callback allowing unrestricted access, letting unauthenticated attackers extract sensitive customer appointment data.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-2262.yaml"}
{"ID":"CVE-2026-22683","Info":{"Name":"Windmill \u003c 1.603.3 - Operator Authorization Bypass","Severity":"high","Description":"Windmill versions 1.276.0 through 1.603.2 contain an authorization bypass vulnerability in the folder management API endpoints. The endpoints for creating, deleting, and managing folder ownership do not enforce role-based access control for operator-level users. In Windmill, operators are restricted users intended to only execute existing scripts, but due to missing server-side authorization checks, operators can create folders, manage folder permissions, and access owner management endpoints. This bypass serves as the prerequisite for exploiting CVE-2026-23696 (SQL injection via folder addowner) enabling full privilege escalation from operator to super admin with remote code execution.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2026/CVE-2026-22683.yaml"}
{"ID":"CVE-2026-22739","Info":{"Name":"Spring Cloud Config Server - Path Traversal","Severity":"high","Description":"Spring Cloud 3.1.x \u003c 3.1.13, 4.1.x \u003c 4.1.9, 4.2.x \u003c 4.2.3, 4.3.x \u003c 4.3.2, and 5.0.x \u003c 5.0.2 contain a path traversal caused by profile parameter substitution in Config Server using native file system backend, letting attackers access files outside configured directories, exploit requires crafted request.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2026/CVE-2026-22739.yaml"}
{"ID":"CVE-2026-22777","Info":{"Name":"ComfyUI-Manager \u003c 3.39.2 - CRLF Configuration Injection","Severity":"high","Description":"ComfyUI-Manager is an extension designed to enhance the usability of ComfyUI. Prior to versions 3.39.2 and 4.0.5, an attacker can inject special characters into HTTP query parameters to add arbitrary configuration values to the config.ini file. This can lead to security setting tampering or modification of application behavior.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-22777.yaml"}
{"ID":"CVE-2026-22778","Info":{"Name":"vLLM 0.8.3 - 0.14.0 - Information Disclosure","Severity":"critical","Description":"vLLM 0.8.3 to - 0.14.1 contains an information disclosure caused by leaking a heap address in error messages from the multimodal endpoint when processing invalid images, letting remote attackers reduce ASLR entropy, exploit requires sending invalid images.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-22778.yaml"}
{"ID":"CVE-2026-22812","Info":{"Name":"OpenCode \u003c 1.0.216 - Unauthenticated Remote Code Execution","Severity":"high","Description":"OpenCode versions prior to 1.0.216 contain an unauthenticated remote code execution vulnerability. The application exposes session and shell execution endpoints without proper authentication, allowing remote attackers to create sessions and execute arbitrary shell commands on the underlying server.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-22812.yaml"}
{"ID":"CVE-2026-23482","Info":{"Name":"Blinko \u003c 1.8.4 - Path Traversal","Severity":"high","Description":"Blinko \u003c 1.8.4 contains a path traversal vulnerability caused by lack of permission checks and filtering on the temp/ path in the file server endpoint, letting unauthorized attackers read arbitrary files including backup files with user notes and tokens, exploit requires no special privileges.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-23482.yaml"}
{"ID":"CVE-2026-23483","Info":{"Name":"Blinko \u003c= 1.8.3 - Path Traversal via /plugins","Severity":"medium","Description":"Blinko \u003c= 1.8.3 contains a path traversal caused by improper path concatenation without verification in the plugin file server endpoint, letting remote attackers access arbitrary files, exploit requires network access.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-23483.yaml"}
{"ID":"CVE-2026-23486","Info":{"Name":"Blinko \u003c= 1.8.3 - User Information Leak","Severity":"low","Description":"Blinko \u003c= 1.8.4 contains an information disclosure caused by a publicly accessible endpoint exposing user information including usernames, roles, and account creation dates, letting remote attackers access sensitive user data, exploit requires no special privileges.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-23486.yaml"}
{"ID":"CVE-2026-23491","Info":{"Name":"InvoicePlane \u003c= 1.6.3 - Arbitrary File Read","Severity":"high","Description":"InvoicePlane through 1.6.3 is vulnerable to an unauthenticated path traversal in the guest \"Get::get_file()\" controller. The supplied filename is passed to readfile() after a single urldecode() with no directory-traversal validation, allowing an unauthenticated attacker to read files outside the customer-files upload directory - including the application's own \"ipconfig.php\", which discloses the database credentials and the application ENCRYPTION_KEY. Fixed in 1.6.4 by the validate_file_access() helper.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-23491.yaml"}
{"ID":"CVE-2026-23536","Info":{"Name":"Feast Feature Server \u003c=0.58.0 - Arbitrary File Read","Severity":"high","Description":"Feast (the open-source Feature Store) Feature Server through 0.58.0 exposes an unauthenticated POST /read-document endpoint that reads an arbitrary, caller-supplied file path with no authentication and no path validation. The read_document_endpoint handler passes the JSON `file_path` field straight to os.path.exists()/open() and returns the file contents in the JSON `content` field, so a remote, unauthenticated attacker can read any file readable by the server process (e.g. /etc/passwd, feature_store.yaml, cloud credentials). Unlike the store-mutating routes it carries no inject_user_details/permission dependency.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-23536.yaml"}
{"ID":"CVE-2026-23550","Info":{"Name":"Modular DS - Broken Access Control","Severity":"high","Description":"Modular DS = 2.5.1 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-23550.yaml"}
{"ID":"CVE-2026-23693","Info":{"Name":"ElementsKit Lite \u003c3.7.9 - Unauthenticated Mailchimp Proxy","Severity":"high","Description":"The ElementsKit Elementor Addons Lite (elementskit-lite) plugin for WordPress before 3.7.9 registers the REST route /wp-json/elementskit/v1/widget/mailchimp/subscribe with no authentication or capability check (CWE-306). The handler accepts client-supplied Mailchimp API credentials and a `list` parameter and issues upstream Mailchimp API requests, letting an unauthenticated attacker use the site as an open proxy to Mailchimp.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-23693.yaml"}
{"ID":"CVE-2026-23696","Info":{"Name":"Windmill \u003c 1.603.3 - SQL Injection","Severity":"critical","Description":"Windmill versions 1.276.0 through 1.603.2 contain an authenticated SQL injection vulnerability in the folder owner management endpoint. The addowner API endpoint passes user-supplied input directly into a SQL query without sanitization, enabling JSONB path injection. An authenticated user with operator-level access can extract sensitive data including JWT secrets, password hashes, API tokens, and database credentials, leading to full privilege escalation and remote code execution.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2026/CVE-2026-23696.yaml"}
{"ID":"CVE-2026-23744","Info":{"Name":"MCPJam Inspector - Remote Code Execution","Severity":"critical","Description":"MCPJam inspector is the local-first development platform for MCP servers. The Latest version 1.4.2 and earlier are vulnerable to a remote code execution (RCE) vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-23744.yaml"}
{"ID":"CVE-2026-23760","Info":{"Name":"SmarterTools SmarterMail - Admin Password Reset","Severity":"critical","Description":"Detected a SmartMail admin password reset vulnerability by sending a POST request to the `/api/v1/auth/force-reset-password` endpoint, indicating that administrative password resets could potentially be triggered without proper authorization.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-23760.yaml"}
@@ -3981,46 +4100,62 @@
{"ID":"CVE-2026-24207","Info":{"Name":"NVIDIA Triton Inference Server \u003c= 26.02 - Authentication Bypass","Severity":"critical","Description":"NVIDIA Triton Inference Server contains an authentication bypass vulnerability, letting attackers bypass authentication and potentially execute code, escalate privileges, tamper data, cause denial of service, or disclose information, exploit requires no special conditions.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-24207.yaml"}
{"ID":"CVE-2026-24423","Info":{"Name":"SmarterMail - Remote Code Execution","Severity":"critical","Description":"SmarterTools SmarterMail \u003c build 9511 contains an unauthenticated remote code execution caused by malicious OS command execution via ConnectToHub API method, letting remote attackers execute arbitrary commands, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-24423.yaml"}
{"ID":"CVE-2026-24477","Info":{"Name":"AnythingLLM - Information Disclosure","Severity":"high","Description":"AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. If AnythingLLM prior to version 1.10.0 is configured to use Qdrant as the vector database with an API key, this QdrantApiKey could be exposed in plain text to unauthenticated users via the `/api/setup-complete` endpoint. Leakage of QdrantApiKey allows an unauthenticated attacker full read/write access to the Qdrant vector database instance used by AnythingLLM. Since Qdrant often stores the core knowledge base for RAG in AnythingLLM, this can lead to complete compromise of the semantic search / retrieval functionality and indirect leakage of confidential uploaded documents. Version 1.10.0 patches the issue.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-24477.yaml"}
{"ID":"CVE-2026-24898","Info":{"Name":"OpenEMR \u003c 8.0.0 - MedEx Callback Unauthenticated Token Disclosure","Severity":"critical","Description":"OpenEMR \u003c 8.0.0 contains an unauthenticated token disclosure caused by bypassing authentication in the MedEx callback endpoint, letting unauthenticated visitors obtain MedEx API tokens and perform unauthorized actions, exploit requires crafted POST request with callback_key.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2026/CVE-2026-24898.yaml"}
{"ID":"CVE-2026-25231","Info":{"Name":"FileRise \u003c= 3.3.0 - Unauthenticated File Read","Severity":"high","Description":"FileRise \u003c= 3.3.0 contains an unauthenticated file read vulnerability caused by a lack of access control on the /uploads directory, letting unauthenticated attackers access uploaded files directly, exploit requires knowledge or guessing of file paths.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-25231.yaml"}
{"ID":"CVE-2026-25512","Info":{"Name":"Group-Office \u003c 26.0.5 - Remote Code Execution","Severity":"critical","Description":"Group-Office before versions 6.8.150, 25.0.82, and 26.0.5 is vulnerable to remote code execution via OS command injection. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmp_file into an exec() call. By injecting shell metacharacters into tmp_file, an authenticated attacker can execute arbitrary system commands on the server.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2026/CVE-2026-25512.yaml"}
{"ID":"CVE-2026-25527","Info":{"Name":"changedetection.io \u003c= 0.52.9 - Unauthenticated Path Traversal","Severity":"medium","Description":"changedetection.io \u003c= 0.53.9 contains a path traversal caused by improper validation of the 'group' parameter in /static/\u003cgroup\u003e/\u003cfilename\u003e route, letting unauthenticated attackers read local application source files.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-25527.yaml"}
{"ID":"CVE-2026-25545","Info":{"Name":"Astro SSR - Server-Side Request Forgery","Severity":"high","Description":"Astro before 5.17.3 and @astrojs/node before 9.5.4 are vulnerable to full-read SSRF due to improper Host header validation in error page rendering, allowing attackers to redirect requests and access internal resources.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2026/CVE-2026-25545.yaml"}
{"ID":"CVE-2026-25555","Info":{"Name":"OpenBullet2 \u003c= 0.3.2 - Authentication Bypass","Severity":"critical","Description":"OpenBullet2 \u003c= 0.3.2 contains an authentication bypass caused by improper API key authentication middleware handling empty X-Api-Key header, letting unauthenticated attackers gain admin access, exploit requires sending empty X-Api-Key header.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-25555.yaml"}
{"ID":"CVE-2026-25616","Info":{"Name":"Blesta \u003c= 5.13.1 - Cross-Site Scripting","Severity":"medium","Description":"Blesta 3.x through 5.x before 5.13.3 contains an input validation vulnerability caused by mishandling input, letting attackers potentially exploit the system, exploit requires unspecified conditions.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-25616.yaml"}
{"ID":"CVE-2026-25703","Info":{"Name":"NeuVector - Information Disclosure","Severity":"high","Description":"NeuVector through 5.4.9 contains an information disclosure vulnerability caused by missing authentication and cached sensitive data in the manager /network/graph API, letting remote attackers access sensitive information, exploit requires no special privileges.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2026/CVE-2026-25703.yaml"}
{"ID":"CVE-2026-25892","Info":{"Name":"Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS","Severity":"high","Description":"Adminer \u003c= 5.4.1 contains a denial of service caused by lack of origin validation in version check endpoint, letting attackers trigger server errors via crafted POST requests, exploit requires no special privileges.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-25892.yaml"}
{"ID":"CVE-2026-25895","Info":{"Name":"FUXA \u003c= 1.2.9 - Unauthenticated Path Traversal to Arbitrary File Write","Severity":"critical","Description":"FUXA, an open-source Node.js SCADA/HMI web interface, through version 1.2.9 exposes an unauthenticated POST /api/upload endpoint that resolves the attacker-controlled `destination` field from the JSON request body against the application directory with only a leading underscore prefix and no containment check. Because path.resolve() honours \"../\" segments, an unauthenticated attacker can escape the application directory and write arbitrary files anywhere on the filesystem reachable by the service account - for example into the public web root (a/../../client/dist), into cron directories, or over SSH authorized_keys - leading to remote code execution. Version 1.2.10 rejects any destination containing a traversal segment and additionally requires an authenticated administrator.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-25895.yaml"}
{"ID":"CVE-2026-26077","Info":{"Name":"Discourse - Unauthenticated Mailpace Webhook Bounce-Score Forgery","Severity":"medium","Description":"Discourse's WebhooksController contains a missing-authentication flaw caused by accepting requests to provider webhook endpoints (including /webhooks/mailpace, SendGrid, Mailjet, Mandrill, Postmark, and SparkPost) without validating a token when none is configured, which is the default state, letting an unauthenticated attacker forge webhook payloads.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2026/CVE-2026-26077.yaml"}
{"ID":"CVE-2026-2614","Info":{"Name":"MLflow \u003c= 3.9.0 - Arbitrary File Read","Severity":"high","Description":"mlflow mlflow \u003c= 3.9.0 contains a path traversal caused by bypassing source path validation via the mlflow.prompt.is_prompt tag in CreateModelVersion request, letting unauthenticated remote attackers read arbitrary files.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-2614.yaml"}
{"ID":"CVE-2026-26190","Info":{"Name":"Milvus - Unauthenticated Metrics API Access","Severity":"critical","Description":"Milvus \u003c 2.5.27 and \u003c 2.6.10 contains an authentication bypass caused by weak default token and unauthenticated REST API on TCP port 9091, letting attackers perform arbitrary expression evaluation and data manipulation, exploit requires network access to port 9091.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-26190.yaml"}
{"ID":"CVE-2026-26216","Info":{"Name":"Crawl4AI \u003c 0.8.0 - Unauthenticated Remote Code Execution via Hooks Parameter","Severity":"critical","Description":"Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remote attackers to import arbitrary modules and execute system commands. Successful exploitation allows full server compromise, including arbitrary command execution, file read and write access, sensitive data exfiltration, and lateral movement within internal networks.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-26216.yaml"}
{"ID":"CVE-2026-26217","Info":{"Name":"Crawl4AI \u003c 0.8.0 - Local File Inclusion","Severity":"critical","Description":"The Crawl4AI Docker API endpoints accepted arbitrary URL schemes without an allow-list. An unauthenticated request with a file:// URL could read local files. Fixed in 0.8.0, which restricts accepted URL schemes.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-26217.yaml"}
{"ID":"CVE-2026-26265","Info":{"Name":"Discourse - Private User Field Disclosure via Directory Items IDOR","Severity":"high","Description":"Discourse prior to 2025.12.2, 2026.1.1, and 2026.2.0 contains an IDOR vulnerability caused by lack of authorization checks on user_field_ids parameter in DirectoryItemsController#index, letting any user retrieve private user field values, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-26265.yaml"}
{"ID":"CVE-2026-26341","Info":{"Name":"Tattile Camera \u003c 1.181.5 - Default Login","Severity":"high","Description":"Tattile Smart+, Vega, and Basic device families firmware \u003c= 1.181.5 contain a broken authentication caused by default credentials not forced to be changed, letting attackers with management interface access gain administrative privileges.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-26341.yaml"}
{"ID":"CVE-2026-2652","Info":{"Name":"MLflow \u003c 3.10.0 - Authentication Bypass on FastAPI Routes","Severity":"high","Description":"A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and served via uvicorn (ASGI). The FastAPI permission middleware only enforces authentication on `/gateway/` routes, leaving other routes such as the Job API (`/ajax-api/3.0/jobs/*`) and the OpenTelemetry trace ingestion API (`/v1/traces`) unprotected. This allows unauthenticated remote attackers to submit jobs, read job results, cancel running jobs, and inject arbitrary trace data into experiments. The issue arises from an architectural mismatch between Flask and FastAPI authentication mechanisms, where the `_find_fastapi_validator()` function fails to handle non-`/gateway/` paths, resulting in a complete authentication bypass. This vulnerability is fixed in version 3.10.0.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2026/CVE-2026-2652.yaml"}
{"ID":"CVE-2026-26980","Info":{"Name":"Ghost CMS Content API - SQL Injection","Severity":"critical","Description":"Ghost CMS before 6.19.1 is vulnerable to a blind SQL injection in the /ghost/api/content/tags/ endpoint via the filter parameter. This template checks for the vulnerability by sending a boolean-based payload.\n","Classification":{"CVSSScore":"9.4"}},"file_path":"http/cves/2026/CVE-2026-26980.yaml"}
{"ID":"CVE-2026-2699","Info":{"Name":"Progress ShareFile Storage Zones Controller - Authentication Bypass","Severity":"critical","Description":"Customer Managed ShareFile Storage Zones Controller (SZC) contains an authentication bypass (Execution After Redirect) that allows unauthenticated attackers to access restricted configuration pages. This leads to changing system configuration and potential remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-2699.yaml"}
{"ID":"CVE-2026-27174","Info":{"Name":"MajorDoMo - Unauthenticated RCE","Severity":"critical","Description":"MajorDoMo contains a remote code execution caused by an include order bug and lack of exit after redirect in admin panel's PHP console, letting unauthenticated attackers execute arbitrary PHP code via crafted GET requests.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-27174.yaml"}
{"ID":"CVE-2026-27176","Info":{"Name":"MajorDoMo - Cross-Site Scripting","Severity":"medium","Description":"MajorDoMo contains a reflected XSS caused by unsanitized $qry parameter in command.php, letting attackers inject arbitrary JavaScript via crafted URLs, exploit requires victim to visit malicious URL.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-27176.yaml"}
{"ID":"CVE-2026-27454","Info":{"Name":"Discourse \u003c=2026.2.0 - Hidden Post Revision Disclosure via revert_to Authorization Bypass","Severity":"medium","Description":"Discourse versions before 2026.1.2, 2026.2.1, and 2026.3.0-latest.1 contain an authorization bypass in PostsController#display_post. The controller calls post.revert_to(params[:version]) directly whenever a version query parameter is present, without checking whether the corresponding PostRevision is hidden or whether the caller has permission to view edit history. By requesting a post at its publicly known version number via GET /posts/:id.json?version=\u003cpublic_version\u003e, the next PostRevision's stored modifications are applied unconditionally. If staff have hidden that revision, its pre-edit content is returned to an unauthenticated caller. On patched installs the same request is rejected with 403 because guardian.ensure_can_see!(post_revision) is evaluated first.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-27454.yaml"}
{"ID":"CVE-2026-27483","Info":{"Name":"MindsDB - Remote Code Execution","Severity":"high","Description":"MindsDB \u003c 25.9.1.1 contains a remote code execution caused by path traversal in the /api/files upload file module, letting authenticated attackers write arbitrary files and execute commands, exploit requires authentication.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-27483.yaml"}
{"ID":"CVE-2026-27542","Info":{"Name":"WooCommerce Wholesale Lead Capture \u003c= 2.0.3.1 - Unauthenticated Privilege Escalation","Severity":"critical","Description":"Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture \u003c= 2.0.3.1 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-27542.yaml"}
{"ID":"CVE-2026-27604","Info":{"Name":"FOSSBilling 0.5.4-0.7.x - Unauthenticated System API Role Authorization Bypass","Severity":"critical","Description":"FOSSBilling versions 0.5.4 through 0.7.x contain an authorization bypass in API role handling. The internal system role is accepted from the URL, resolves to the cron-admin identity, and reaches privileged system API methods without authentication, a session, or a CSRF token. Version 0.8.0 rejects the system route role.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-27604.yaml"}
{"ID":"CVE-2026-27645","Info":{"Name":"Changedetection.io RSS Single Watch - Cross-Site Scripting","Severity":"medium","Description":"changedetection.io \u003c 0.54.1 contains a stored XSS caused by unescaped reflection of UUID path parameter in RSS single-watch endpoint, letting remote attackers execute JavaScript in victim's browser, exploit requires victim to visit crafted URL.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-27645.yaml"}
{"ID":"CVE-2026-27760","Info":{"Name":"OpenCATS - Command Injection","Severity":"high","Description":"OpenCATS prior to commit 3002a29 contains a command injection caused by injection of PHP statements into the installer AJAX endpoint's databaseConnectivity action parameter, letting unauthenticated attackers execute arbitrary code, exploit requires incomplete installation wizard.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2026/CVE-2026-27760.yaml"}
{"ID":"CVE-2026-27771","Info":{"Name":"Gitea Container Registry - Unauthorized Private Image Access","Severity":"high","Description":"Gitea \u003c 1.26.2 allows unauthenticated remote attackers to pull private container images.The /v2/token endpoint grants anonymous ghost tokens (UserID:-1) with no scope restriction.The ReqContainerAccess middleware does not check package owner visibility, so ghost users can enumerate all container repositories via /_catalog and pull any private image layer.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-27771.yaml"}
{"ID":"CVE-2026-27796","Info":{"Name":"Homarr \u003c 1.54.0 - Information Disclosure","Severity":"medium","Description":"Homarr \u003c 1.54.0 contains an information disclosure caused by the integration.all tRPC endpoint being exposed as a publicProcedure, letting unauthenticated users retrieve sensitive integration metadata, exploit requires no authentication.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-27796.yaml"}
{"ID":"CVE-2026-27826","Info":{"Name":"mcp-atlassian \u003c 0.17.0 - Server-Side Request Forgery","Severity":"high","Description":"MCP Atlassian \u003c 0.17.0 contains a server-side request forgery caused by improper validation of custom HTTP headers in the HTTP middleware, letting unauthenticated attackers force outbound requests to arbitrary URLs, exploit requires access to the mcp-atlassian HTTP endpoint.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2026/CVE-2026-27826.yaml"}
{"ID":"CVE-2026-27833","Info":{"Name":"Piwigo \u003c 16.3.0 - Unauthenticated Information Disclosure via History API","Severity":"high","Description":"Piwigo \u003c= 16.3.0 contains an information disclosure vulnerability caused by the pwg.history.search API method lacking admin_only restriction, letting unauthenticated users access full browsing history, exploit requires no authentication\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-27833.yaml"}
{"ID":"CVE-2026-27934","Info":{"Name":"Discourse \u003c 2026.1.2/2026.2.1/2026.3.0-latest.1 - Unauthenticated Private User Action Disclosure","Severity":"high","Description":"Discourse \u003c 2026.1.2/2026.2.1/2026.3.0-latest.1 contains an information disclosure vulnerability caused by lack of visibility checks in a user action API endpoint, letting unauthorized users access post titles and excerpts, exploit requires no special privileges.\n","Classification":{"CVSSScore":"8.7"}},"file_path":"http/cves/2026/CVE-2026-27934.yaml"}
{"ID":"CVE-2026-27944","Info":{"Name":"Nginx UI \u003c 2.3.3 - Information Disclosure","Severity":"critical","Description":"Nginx UI \u003c 2.3.3 contains an information disclosure vulnerability caused by unauthenticated access to /api/backup endpoint exposing encryption keys in X-Backup-Security header, letting unauthenticated attackers download and decrypt full system backups.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-27944.yaml"}
{"ID":"CVE-2026-27960","Info":{"Name":"OpenCTI \u003c 6.9.13 - Authentication Bypass via User Impersonation","Severity":"critical","Description":"OpenCTI \u003c 6.9.13 allows authentication bypass by supplying a Bearer token set to the admin user's internal_id UUID instead of a valid JWT. The default admin internal_id (88ec0c6a-13ce-5e39-b486-354fe4a7084f) grants full admin access to the GraphQL API, effectively bypassing all authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-27960.yaml"}
{"ID":"CVE-2026-27971","Info":{"Name":"Qwik - Unauthenticated RCE via server$ Deserialization","Severity":"critical","Description":"Qwik \u003c=1.19.0 contains an insecure deserialization vulnerability in the server$ RPC mechanism, letting unauthenticated attackers execute arbitrary code remotely, exploit requires require() availability at runtime.\n","Classification":{"CVSSScore":"9.2"}},"file_path":"http/cves/2026/CVE-2026-27971.yaml"}
{"ID":"CVE-2026-28141","Info":{"Name":"NextGEN Gallery \u003c= 4.2.3 - Reflected Cross-Site Scripting","Severity":"high","Description":"NextGEN Gallery through 4.2.3 reflects a URL-decoded `ngg_tag` route value into the generated tag page without the context-specific escaping added in 4.2.4. An unauthenticated attacker can break out of the tag context and inject an auto-executing script. This template injects an `svg onload` payload carrying a random nonce and matches its unencoded reflection; slash and backtick syntax keep the request off common WAF signatures.\n","Classification":{"CVSSScore":"7.1"}},"file_path":"http/cves/2026/CVE-2026-28141.yaml"}
{"ID":"CVE-2026-28288","Info":{"Name":"Dify User Enumeration via Observable Response Discrepancy","Severity":"medium","Description":"Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-28288.yaml"}
{"ID":"CVE-2026-28358","Info":{"Name":"NocoDB - User Enumeration","Severity":"medium","Description":"NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint returned different responses for registered and unregistered emails, allowing user enumeration. This issue has been patched in version 0.301.3.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-28358.yaml"}
{"ID":"CVE-2026-28409","Info":{"Name":"WeGIA \u003c= 3.6.4 - Remote Code Execution","Severity":"critical","Description":"WeGIA \u003c= 3.6.5 contains a remote code execution caused by improper validation of backup file names in the database restoration functionality, letting attackers with administrative access execute arbitrary OS commands\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-28409.yaml"}
{"ID":"CVE-2026-28411","Info":{"Name":"WeGIA \u003c 3.6.5 - Unauthenticated Authentication Bypass via extract()","Severity":"critical","Description":"WeGIA \u003c 3.6.5 contains an authentication bypass caused by unsafe use of extract() on $_REQUEST, letting unauthenticated attackers bypass authentication and access protected areas, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-28411.yaml"}
{"ID":"CVE-2026-28414","Info":{"Name":"Gradio - Absolute Path Traversal","Severity":"high","Description":"Gradio \u003c 6.7 on Windows with Python 3.13+ contains an absolute path traversal caused by incorrect path validation in path joining logic, letting unauthenticated attackers read arbitrary files from the server.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-28414.yaml"}
{"ID":"CVE-2026-28496","Info":{"Name":"FOSSBilling - Server-Side Template Injection","Severity":"critical","Description":"A Server-Side Template Injection (SSTI) vulnerability exists in FOSSBilling's template rendering system. Administrators with access to features that render Twig templates (email templates, mass mail campaigns, custom payment adapters, and the string_render API endpoint) can inject arbitrary Twig expressions, leading to information disclosure and remote code execution. The vulnerability exists because Twig templates are rendered without a sandbox, allowing access to the full Twig environment, API context, and the application's dependency injection container.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-28496.yaml"}
{"ID":"CVE-2026-29014","Info":{"Name":"MetInfo CMS \u003c= 8.1 - Remote Code Execution","Severity":"critical","Description":"MetInfo CMS 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability caused by insufficient input neutralization in the execution path, letting remote attackers execute arbitrary code remotely, exploit requires crafted requests.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-29014.yaml"}
{"ID":"CVE-2026-29058","Info":{"Name":"WWBN AVideo Encoder \u003c 7.0 - Unauthenticated OS Command Injection","Severity":"critical","Description":"AVideo \u003c 7.0 contains a command injection caused by shell command substitution in the base64Url GET parameter, letting unauthenticated attackers execute arbitrary OS commands, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-29058.yaml"}
{"ID":"CVE-2026-29059","Info":{"Name":"Windmill/Nextcloud Flow \u003c 1.603.3 - Unauthenticated Path Traversal","Severity":"critical","Description":"Windmill \u003c 1.603.3 contains a path traversal caused by unsanitized filename parameter in get_log_file endpoint, letting unauthenticated attackers read arbitrary files on the server, exploit requires no authentication.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-29059.yaml"}
{"ID":"CVE-2026-29066","Info":{"Name":"TinaCMS - Path Traversal","Severity":"medium","Description":"TinaCMS CLI \u003c 2.1.8 contains a file system read vulnerability caused by disabled Vite server.fs.strict setting, letting unauthenticated attackers read arbitrary files on the host system, exploit requires access to the dev server.\n","Classification":{"CVSSScore":"6.2"}},"file_path":"http/cves/2026/CVE-2026-29066.yaml"}
{"ID":"CVE-2026-29183","Info":{"Name":"SiYuan Note - Cross-Site Scripting","Severity":"medium","Description":"Unauthenticated reflected cross-site scripting (XSS) vulnerability in all versions of SiYuan Note containing `/api/icon/getDynamicIcon` with unsafe `type=8` rendering logic. Attacker-controlled `content` is inserted directly into SVG output without proper sanitization. An attacker can execute arbitrary JavaScript in users' browsers when they visit a crafted malicious link.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-29183.yaml"}
{"ID":"CVE-2026-29962","Info":{"Name":"HSC MailInspector - Local File Inclusion","Severity":"high","Description":"HSC MailInspector v5.3.3-7 contains a path traversal caused by improper control of user-supplied file paths in /vendor/phpunit/phpunit.php, letting remote attackers read arbitrary files, exploit requires crafted request.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-29962.yaml"}
{"ID":"CVE-2026-29963","Info":{"Name":"HSC MailInspector - Unauthenticated Arbitrary File Read","Severity":"high","Description":"HSC MailInspector 5.3.3-7 contains a path traversal caused by improper validation of user-supplied input in /tap/dw.php text parameter, letting remote attackers access arbitrary files, exploit requires crafted request.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-29963.yaml"}
{"ID":"CVE-2026-3001","Info":{"Name":"Gutenverse Plugin \u003c= 3.4.6 - Cross-Site Scripting","Severity":"medium","Description":"The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to and including 3.4.6. The issue arises due to insufficient input sanitization and output escaping in the `render_content()` method of `class-search-result-title.php`, which outputs the value of `get_query_var('s')` directly into the page HTML without applying `esc_html()`. This makes it possible for unauthenticated attackers to inject and execute arbitrary web scripts in pages via a crafted URL, provided the `gutenverse/search-result-title` block is present on the site's search results template.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-3001.yaml"}
{"ID":"CVE-2026-3018","Info":{"Name":"WordPress Newsletters \u003c= 4.13 - Unauthenticated SQL Injection","Severity":"high","Description":"Newsletters WordPress plugin \u003c= 4.13 contains a time-based SQL injection caused by insufficient escaping of the 'wpmlsubscriber_id' parameter, letting unauthenticated attackers extract sensitive database information.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-3018.yaml"}
{"ID":"CVE-2026-3055","Info":{"Name":"Citrix NetScaler SAML IDP - Memory Overread","Severity":"critical","Description":"NetScaler ADC and NetScaler Gateway contain an insufficient input validation vulnerability when configured as a SAML IDP, leading to memory overread, letting attackers potentially access sensitive memory, exploit requires configuration as SAML IDP\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-3055.yaml"}
{"ID":"CVE-2026-30623","Info":{"Name":"LiteLLM 1.18.10 - Command Injection","Severity":"high","Description":"LiteLLM 1.18.10 contains a remote code execution caused by lack of validation of arbitrary command and args in MCP server creation, letting attackers execute OS commands remotely, exploit requires crafted JSON configuration.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-30623.yaml"}
{"ID":"CVE-2026-30824","Info":{"Name":"Flowise - NVIDIA NIM Endpoints Missing Authentication","Severity":"high","Description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router (/api/v1/nvidia-nim/*) is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generation endpoints.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2026/CVE-2026-30824.yaml"}
{"ID":"CVE-2026-30849","Info":{"Name":"MantisBT \u003c 2.28.1 - SOAP API Authentication Bypass","Severity":"critical","Description":"Mantis Bug Tracker \u003c 2.28.1 on MySQL databases contains an authentication bypass caused by improper type checking on the password parameter in the SOAP API, letting attackers login without the actual password using a crafted SOAP envelope, exploit requires knowing the victim's username.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-30849.yaml"}
{"ID":"CVE-2026-30928","Info":{"Name":"Glances - Information Disclosure","Severity":"high","Description":"Glances \u003c 4.5.1 contains an information disclosure vulnerability caused by unfiltered exposure of sensitive configuration data via the /api/4/config REST API endpoint, letting remote attackers access credentials, exploit requires API access.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-30928.yaml"}
{"ID":"CVE-2026-30958","Info":{"Name":"OneUptime \u003c 10.0.21 - Path Traversal","Severity":"high","Description":"OneUptime \u003c 10.0.21 contains a path traversal caused by unsanitized componentName parameter in /workflow/docs/:componentName endpoint, letting unauthenticated attackers read arbitrary files from the server filesystem.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2026/CVE-2026-30958.yaml"}
{"ID":"CVE-2026-30965","Info":{"Name":"Parse Server \u003c 8.6.21 / 9.x \u003c 9.5.2 - Session Token Exfiltration","Severity":"critical","Description":"Parse Server \u003c 8.6.21 / 9.x \u003c 9.5.2 contains an information disclosure vulnerability caused by improper handling of the redirectClassNameForKey query parameter, letting authenticated or unauthenticated attackers exfiltrate session tokens, exploit requires ability to create or update an object with a new relation field depending on Class-Level Permissions.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2026/CVE-2026-30965.yaml"}
@@ -4029,6 +4164,8 @@
{"ID":"CVE-2026-31816","Info":{"Name":"Budibase - Authentication Bypass","Severity":"critical","Description":"Budibase \u003c= 3.31.4 contains an authentication bypass caused by unanchored regex in authorized() middleware matching webhook path patterns in query strings, letting unauthenticated remote attackers access any server-side API endpoint, exploit requires crafted request with webhook pattern in URL.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-31816.yaml"}
{"ID":"CVE-2026-31831","Info":{"Name":"Tautulli \u003c= 2.16.1 - Path Traversal","Severity":"high","Description":"Tautulli is a monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the `/newsletter/image/images` endpoint joins user-controlled path segments onto the newsletter image directory without containment validation. Authentication is not required for this endpoint, allowing unauthenticated attackers to perform directory traversal and read arbitrary files accessible to the server process. Reading `config/config.ini` discloses the API key, the hashed admin password, the JWT token secret, and the Plex Media Server token. Version 2.17.0 fixes this issue.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-31831.yaml"}
{"ID":"CVE-2026-32230","Info":{"Name":"Uptime-Kuma \u003c v1.23.0 - Improper Access Control","Severity":"medium","Description":"Uptime-Kuma before v1.23.0 is vulnerable to an information disclosure issue due to missing authorization on the /api/badge/1/ping/24 endpoint. An unauthenticated attacker can access this endpoint to leak ping statistics, such as average ping and ping history, for existing monitors without needing access to the protected status page. This can lead to unintended exposure of internal monitoring data.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-32230.yaml"}
{"ID":"CVE-2026-32255","Info":{"Name":"Kan \u003c= 0.5.4 - Server-Side Request Forgery","Severity":"high","Description":"Kan, an open-source project management tool (Trello alternative), versions 0.5.4 and below are vulnerable to an unauthenticated Server-Side Request Forgery in the /api/download/attatchment endpoint. The endpoint passes the attacker-controlled `url` query parameter straight to a server-side fetch() without validating the destination host, allowing an unauthenticated attacker to make the server issue arbitrary outbound HTTP requests and read back the full response body.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2026/CVE-2026-32255.yaml"}
{"ID":"CVE-2026-32475","Info":{"Name":"Elementor Pro \u003c=4.2.1 - Unauthenticated Arbitrary File Upload via Form Handler","Severity":"critical","Description":"Elementor Pro plugin for WordPress in versions \u003c=4.2.1 is vulnerable to unauthenticated arbitrary file upload in the Forms module File Upload field. The validation() and process_field() methods iterate over submitted file entries with different early-exit logic for UPLOAD_ERR_NO_FILE entries. When an attacker submits two file parts for the same upload field — an empty first entry (blank filename triggering UPLOAD_ERR_NO_FILE) followed by a payload — validation() returns early after the empty entry without ever type-checking the payload, while process_field() only skips (continue) the empty entry and moves the payload to wp-content/uploads/elementor/forms/. The AJAX action elementor_pro_forms_send_form requires no authentication or nonce.\n","Classification":{"CVSSScore":"9.0"}},"file_path":"http/cves/2026/CVE-2026-32475.yaml"}
{"ID":"CVE-2026-32583","Info":{"Name":"Webnus Inc. Modern Events Calendar - Broken Access Control","Severity":"medium","Description":"Webnus Inc. Modern Events Calendar \u003c= 7.29.0 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers bypass authorization, exploit requires no special privileges.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-32583.yaml"}
{"ID":"CVE-2026-32596","Info":{"Name":"Glances - Information Disclosure","Severity":"high","Description":"Glances \u003c 4.5.2 contains an information disclosure vulnerability caused by the web server running without authentication by default, letting remote attackers access sensitive system information including credentials, exploit requires no special privileges.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-32596.yaml"}
{"ID":"CVE-2026-3296","Info":{"Name":"Everest Forms WordPress Plugin \u003c= 3.4.3 - PHP Object Injection","Severity":"critical","Description":"The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize() on stored entry meta values without passing the allowed_classes parameter. This makes it possible for unauthenticated attackers to inject a serialized PHP object payload through any public Everest Forms form field. The payload survives sanitize_text_field() sanitization (serialization control characters are not stripped) and is stored in the wp_evf_entrymeta database table. When an administrator views entries or views an individual entry, the unsafe unserialize() call processes the stored data without class restrictions.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-3296.yaml"}
@@ -4039,6 +4176,7 @@
{"ID":"CVE-2026-3326","Info":{"Name":"XStore Theme \u003c 9.7.3 - SQL Injection","Severity":"high","Description":"The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2026/CVE-2026-3326.yaml"}
{"ID":"CVE-2026-33340","Info":{"Name":"LoLLMs WEBUI - Server-Side Request Forgery","Severity":"critical","Description":"LoLLMs WEBUI contains a server-side request forgery caused by unauthenticated access to the /api/proxy endpoint, letting attackers force the server to make arbitrary GET requests, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-33340.yaml"}
{"ID":"CVE-2026-3335","Info":{"Name":"Canto \u003c= 3.1.1 - Missing Authorization to Unauthenticated File Upload","Severity":"medium","Description":"The Canto plugin for WordPress is vulnerable to missing authorization in the copy-media.php upload flow.\nThe file is directly accessible and accepts attacker-controlled parameters for the upload destination, allowing unauthenticated users to upload arbitrary files constrained to WordPress-allowed MIME types.\nThe fbc_app_api parameter controls the domain WordPress fetches from via wp_safe_remote_get, enabling SSRF to attacker-controlled infrastructure.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-3335.yaml"}
{"ID":"CVE-2026-33425","Info":{"Name":"Discourse - Private Group Membership Inference via exclude_groups","Severity":"medium","Description":"Discourse \u003c 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contains an information disclosure caused by unauthenticated users observing directory results changes with the exclude_groups parameter, letting attackers determine private group membership, exploit requires public access to user directory.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-33425.yaml"}
{"ID":"CVE-2026-33439","Info":{"Name":"OpenAM \u003c= 16.0.5 - Pre-Auth RCE via jato.clientSession Deserialization","Severity":"critical","Description":"Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. This vulnerability is fixed in 16.0.6.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-33439.yaml"}
{"ID":"CVE-2026-33476","Info":{"Name":"SiYuan \u003c= v3.6.1 - Path Traversal","Severity":"high","Description":"SiYuan is a personal knowledge management system. Prior to version 3.6.2, the Siyuan kernel exposes an unauthenticated file-serving endpoint under `/appearance/*filepath.` Due to improper path sanitization, attackers can perform directory traversal and read arbitrary files accessible to the server process. Authentication checks explicitly exclude this endpoint, allowing exploitation without valid credentials. Version 3.6.2 fixes this issue.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-33476.yaml"}
{"ID":"CVE-2026-33478","Info":{"Name":"AVideo \u003c= 26.0 - WWBN AVideo - Remote Code Execution","Severity":"critical","Description":"WWBN AVideo \u003c= 26.0 contains multiple vulnerabilities in the CloneSite plugin including unauthenticated exposure of clone secret keys and OS command injection in rsync command construction, letting unauthenticated attackers achieve remote code execution.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-33478.yaml"}
@@ -4049,8 +4187,10 @@
{"ID":"CVE-2026-3395","Info":{"Name":"MaxSite CMS \u003c=109.1 - Remote Code Execution","Severity":"high","Description":"MaxSite CMS through 109.1 allows unauthenticated remote attackers to execute arbitrary code via the MarkItUp editor preview AJAX endpoint, preview-ajax.php. The endpoint insufficiently authenticates the request, failing to ensure the user is logged in, and processes the attacker's input via unsafe usage of PHP eval() on user-supplied [php]...[/php] shortcodes. By providing a POST request to the vulnerable /ajax/ endpoint with crafted input, attackers may achieve remote code execution. The issue is addressed in version 109.2 by implementing proper authentication controls.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2026/CVE-2026-3395.yaml"}
{"ID":"CVE-2026-3396","Info":{"Name":"WCAPF WooCommerce Ajax Product Filter - SQL Injection","Severity":"high","Description":"WCAPF WooCommerce Ajax Product Filter \u003c= 4.2.3 contains a time-based SQL injection caused by insufficient escaping of the 'post-author' parameter, letting unauthenticated attackers extract sensitive database information remotely.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-3396.yaml"}
{"ID":"CVE-2026-34036","Info":{"Name":"Dolibarr \u003c=22.0.4 - Local File Inclusion","Severity":"medium","Description":"Dolibarr \u003c= 22.0.4 contains a local file inclusion caused by manipulation of the objectdesc parameter and a fail-open logic flaw in restrictedArea() in /core/ajax/selectobject.php, letting authenticated users with no specific privileges read arbitrary non-PHP files.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2026/CVE-2026-34036.yaml"}
{"ID":"CVE-2026-34151","Info":{"Name":"XWiki Platform - Path Traversal","Severity":"high","Description":"XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected lookup is replaced with Environment.getResourceAsStream(String, String), which constrains a resource to its expected prefix. An unauthenticated remote attacker can use the vulnerable behavior to read arbitrary resources permitted to the Jetty process, including WEB-INF/xwiki.cfg and, depending on deployment depth and operating-system permissions, host files. Tomcat and Jetty versions before 12 do not appear affected. This issue is fixed in versions 17.10.5 and 18.2.0.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2026/CVE-2026-34151.yaml"}
{"ID":"CVE-2026-34156","Info":{"Name":"NocoBase - VM Sandbox Escape to Remote Code Execution","Severity":"critical","Description":"NocoBase Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist controlled by WORKFLOW_SCRIPT_MODULES env var. The console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console._stdout and console._stderr. An authenticated attacker can traverse the prototype chain (console._stdout.constructor.constructor to Function to process to child_process) to escape the sandbox and achieve Remote Code Execution as root.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-34156.yaml"}
{"ID":"CVE-2026-34197","Info":{"Name":"Apache ActiveMQ - Remote Code Execution","Severity":"critical","Description":"Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: . Users are recommended to upgrade to version 5.19.5 or 6.2.3, which fixes the issue.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-34197.yaml"}
{"ID":"CVE-2026-34234","Info":{"Name":"CtrlPanel \u003c= 1.1.1 - Remote Code Execution","Severity":"critical","Description":"CtrlPanel versions \u003c= 1.1.1 are vulnerable to unauthenticated Remote Code Execution (RCE) via the web installer endpoint (public/installer/index.php). The installer loaded and executed form handler files before checking for the install.lock gate, allowing attackers to reach installer forms on fully-deployed instances. User-supplied POST values (url, key, clientkey) from the Pterodactyl configuration form were interpolated directly into shell command strings executed via bash -c without sanitization, enabling command injection. The vulnerability is confirmed actively exploited in the wild.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-34234.yaml"}
{"ID":"CVE-2026-34413","Info":{"Name":"Xerte Online Toolkits \u003c= 3.15 - Remote Code Execution","Severity":"critical","Description":"Xerte Online Toolkits versions 3.15 and earlier expose the elFinder file manager connector at /editor/elfinder/php/connector.php without authentication (CVE-2026-34413), because the access-control redirect for unauthenticated users does not call exit()/die() and execution continues server-side. This is chained with a relative path traversal in the elFinder rename command (CVE-2026-34414) and an incomplete file-extension blocklist that still permits .php4 (CVE-2026-34415) to write an attacker-controlled PHP file into the application root, resulting in unauthenticated remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-34413.yaml"}
{"ID":"CVE-2026-34453","Info":{"Name":"SiYuan \u003c= v3.6.1 - Bookmark Data Disclosure","Severity":"high","Description":"SiYuan v3.6.2 contains an information disclosure vulnerability caused by improper authorization checks in the publish service's bookmark filtering, letting unauthenticated visitors access bookmarked blocks from password-protected documents, exploit requires access to the publish service.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-34453.yaml"}
{"ID":"CVE-2026-34486","Info":{"Name":"Apache Tomcat Tribes EncryptInterceptor Bypass - Remote Code Execution","Severity":"critical","Description":"Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-34486.yaml"}
@@ -4061,8 +4201,10 @@
{"ID":"CVE-2026-34910","Info":{"Name":"UniFi OS Server - Command Injection","Severity":"critical","Description":"A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-34910.yaml"}
{"ID":"CVE-2026-34976","Info":{"Name":"Dgraph \u003c=v25.3.0 - Admin Mutation Missing Authorization","Severity":"critical","Description":"Dgraph \u003c=v25.3.0 contains an authentication bypass caused by missing authorization middleware for the restoreTenant admin mutation, letting unauthenticated attackers overwrite the database, read files, and perform SSRF, exploit requires no authentication.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-34976.yaml"}
{"ID":"CVE-2026-35029","Info":{"Name":"LiteLLM - Arbitrary File Read","Severity":"high","Description":"LiteLLM \u003c 1.83.0 contains a broken access control vulnerability caused by lack of admin role enforcement on /config/update endpoint, letting authenticated users modify configurations, execute code, read files, and take over accounts.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-35029.yaml"}
{"ID":"CVE-2026-35037","Info":{"Name":"Ech0 \u003c 4.2.8 - Server-Side Request Forgery","Severity":"high","Description":"Ech0 before 4.2.8 exposes an unauthenticated SSRF vulnerability in GET /api/website/title. The website_url query parameter is fetched server-side without validating the target host or IP address.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2026/CVE-2026-35037.yaml"}
{"ID":"CVE-2026-35273","Info":{"Name":"Oracle PeopleSoft PeopleTools PSEMHUB - Pre-Auth Java Deserialization RCE","Severity":"critical","Description":"Oracle PeopleSoft PeopleTools 8.61 and 8.62 contain a remote code execution vulnerability in Updates Environment Management, letting unauthenticated network attackers fully compromise the system, exploit requires network access via HTTP.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-35273.yaml"}
{"ID":"CVE-2026-35616","Info":{"Name":"FortiClient EMS - Authentication Bypass","Severity":"high","Description":"Detects whether Fortinet hotfix FG-IR-26-099 for CVE-2026-35616 is missing by comparing behavioral responses from a certificate-authenticated endpoint. The template sends X-SSL-CLIENT-VERIFY: SUCCESS without certificate material and checks whether this spoofed header changes server behavior.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-35616.yaml"}
{"ID":"CVE-2026-3576","Info":{"Name":"Planyo Online Reservation System \u003c= 3.0 - Arbitrary File Read","Severity":"high","Description":"The Planyo Online Reservation System plugin for WordPress through 3.0 ships ulap.php, an AJAX proxy that is directly reachable without WordPress bootstrapping or authentication. The send_http_post() function validates the host of the supplied URL against an allowlist that includes localhost, but never validates the URL scheme, so a file://localhost/ URL passes the host check and is handed to curl_init() or fopen(). Both support the file:// wrapper, so the contents of arbitrary local files are returned in the response.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2026/CVE-2026-3576.yaml"}
{"ID":"CVE-2026-3584","Info":{"Name":"WordPress Kali Forms \u003c= 2.4.9 - Remote Code Execution","Severity":"critical","Description":"Kali Forms WordPress plugin \u003c= 2.4.9 contains a remote code execution caused by unsafe user input handling in 'form_process' and 'prepare_post_data' functions, letting unauthenticated attackers execute code on the server, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-3584.yaml"}
{"ID":"CVE-2026-38360","Info":{"Name":"dash-uploader 0.1.0 - 0.7.0a2 - Unauthenticated Arbitrary File Write via Path Traversal","Severity":"critical","Description":"fohrloop dash-uploader v0.1.0 through v0.7.0a2 contains a directory traversal vulnerability caused by improper handling in dash_uploader/httprequesthandler.py components, letting remote attackers execute arbitrary code, exploit requires no special privileges.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-38360.yaml"}
{"ID":"CVE-2026-38361","Info":{"Name":"dash-uploader 0.1.0 - 0.7.0a2 - Denial-of-Service via flowTotalChunks","Severity":"high","Description":"fohrloop dash-uploader v0.1.0 through v0.7.0a2 contains a remote code execution caused by improper handling in Upload function and max_file_size parameter in dash_uploader components, letting remote attackers execute arbitrary code, exploit requires crafted request.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-38361.yaml"}
@@ -4077,39 +4219,54 @@
{"ID":"CVE-2026-40105","Info":{"Name":"XWiki - Cross-Site Scripting","Severity":"medium","Description":"XWiki is vulnerable to reflected Cross-Site Scripting (XSS) via the `viewer=changes` endpoint. The `rev2` parameter is not properly sanitised before being rendered in the response, allowing an attacker to inject arbitrary JavaScript. Affects XWiki versions prior to the patched release.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-40105.yaml"}
{"ID":"CVE-2026-40151","Info":{"Name":"PraisonAI AgentOS - Information Disclosure","Severity":"medium","Description":"PraisonAI's AgentOS FastAPI application server exposes an unauthenticated `GET /api/agents` endpoint that lists every registered agent's name, role and the opening of its instructions (system prompt). No authentication is enforced on the route, allowing a remote attacker to enumerate agent configurations and harvest sensitive details embedded in system prompts, such as internal API references, business logic and credential hints. This endpoint belongs to the AgentOS FastAPI server and is distinct from the legacy Flask `/agents` server tracked as CVE-2026-44338.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-40151.yaml"}
{"ID":"CVE-2026-4020","Info":{"Name":"Gravity SMTP WordPress Plugin - Sensitive Information Exposure","Severity":"high","Description":"Gravity SMTP WordPress plugin \u003c= 2.1.4 contains a sensitive information exposure caused by an unrestricted REST API endpoint at /wp-json/gravitysmtp/v1/tests/mock-data, letting unauthenticated attackers retrieve detailed system configuration data, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-4020.yaml"}
{"ID":"CVE-2026-40217","Info":{"Name":"LiteLLM \u003c 1.25.0 - Remote Code Execution","Severity":"high","Description":"LiteLLM before 1.25.0 allows authenticated users with the master API key to execute arbitrary Python code through the /guardrails/test_custom_code endpoint intended for custom guardrail testing. The endpoint’s insufficient filtering mechanisms can be bypassed, allowing attackers to abuse Python’s string operations and bytecode manipulation to break out of the restricted environment. Successful exploitation may lead to remote code execution as the LiteLLM process user, which may be root when using the default Docker image.\n","Classification":{"CVSSScore":"8.7"}},"file_path":"http/cves/2026/CVE-2026-40217.yaml"}
{"ID":"CVE-2026-40242","Info":{"Name":"Arcane \u003c= 1.17.2 - Server-Side Request Forgery","Severity":"high","Description":"Arcane \u003c= 1.17.3 contains an unauthenticated server-side request forgery caused by lack of URL scheme and host validation in /api/templates/fetch endpoint, letting remote attackers perform SSRF, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2026/CVE-2026-40242.yaml"}
{"ID":"CVE-2026-40280","Info":{"Name":"Gotenberg \u003c= 8.30.1 - Server Side Request Forgery","Severity":"critical","Description":"Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression (^https?://) to match URL schemes. Because Go's net/url.Parse() normalizes the scheme to lowercase before establishing the outbound TCP connection, an attacker can bypass the deny-list by simply capitalizing part of the URL scheme (e.g., HTTP://, HTTPS://, or Http://). This allows unauthenticated requests to reach internal network services, including private IP ranges, loopback addresses, and cloud instance metadata endpoints such as HTTP://169.254.169.254/latest/meta-data.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-40280.yaml"}
{"ID":"CVE-2026-40281","Info":{"Name":"Gotenberg \u003c= 8.30.1 - Remote Code Execution","Severity":"critical","Description":"Gotenberg through 8.30.1 sanitizes only the keys of the JSON metadata submitted to the PDF metadata write endpoint, leaving the values unvalidated. A newline inside a metadata value is written straight to the ExifTool process standard input, where it terminates the current argument and starts a new one, letting an unauthenticated attacker inject arbitrary ExifTool arguments and execute operating system commands through an advanced formatting expression.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-40281.yaml"}
{"ID":"CVE-2026-40308","Info":{"Name":"My Calendar WordPress Plugin - Information Disclosure","Severity":"high","Description":"My Calendar WordPress plugin \u003c= 3.7.6 contains an injection vulnerability caused by unvalidated user input passed to parse_str() in mc_ajax_mcjs_action endpoint, letting unauthenticated attackers access or crash sites via switch_to_blog(), exploit requires WordPress Multisite or Single Site setup.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-40308.yaml"}
{"ID":"CVE-2026-40466","Info":{"Name":"Apache ActiveMQ - Remote Code Execution via HTTP Discovery Transport Bypass","Severity":"high","Description":"Apache ActiveMQ before 5.19.6 and 6.0.0 through 6.2.4 is vulnerable to remote code execution via a bypass of the CVE-2026-34197 security fix. The original fix blocked the \"vm://\" transport scheme in BrokerView.addNetworkConnector() and BrokerView.addConnector() to prevent authenticated attackers from loading malicious Spring XML configurations via the Jolokia API. However, the fix only denied the \"vm\" scheme. An attacker can bypass this restriction by using the HTTP Discovery transport(http://attacker/discovery), which is not in the denied scheme list. The attacker-controlled HTTP endpoint returns a vm:// transport URI as a second-stage response, which then loads a remote Spring XML application context, leading to arbitrary code execution on the broker JVM. The activemq-http module must be on the classpath (present by default in the \"all\" distribution), and authenticated access to the Jolokia API (/api/jolokia/) is required.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-40466.yaml"}
{"ID":"CVE-2026-4060","Info":{"Name":"Geo Mashup \u003c= 1.13.18 - SQL Injection","Severity":"high","Description":"Geo Mashup WordPress plugin \u003c= 1.13.18 is vulnerable to time-based SQL injection via the sort parameter. The issue exists because the sort value is insufficiently sanitized in render-map.php/template tag code paths.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-4060.yaml"}
{"ID":"CVE-2026-40878","Info":{"Name":"Mailcow \u003c 2026-03b - Href Link Injection","Severity":"low","Description":"mailcow \u003c 2026-03b reflects raw REQUEST_URI into JavaScript and href links on the login page, allowing attackers to inject parameters that break JS logic and enable phishing.\n","Classification":{"CVSSScore":"3.1"}},"file_path":"http/cves/2026/CVE-2026-40878.yaml"}
{"ID":"CVE-2026-40887","Info":{"Name":"Vendure Core - SQL Injection","Severity":"critical","Description":"Vendure, an open-source headless commerce platform built on Node.js/TypeScript, contains a critical SQL injection vulnerability in its Shop API. The languageCode query parameter is interpolated directly into a raw SQL CASE expression in ProductService.findOneBySlug without parameterization or input validation, allowing unauthenticated attackers to execute arbitrary SQL commands. This can lead to full database disclosure and denial of service.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-40887.yaml"}
{"ID":"CVE-2026-41042","Info":{"Name":"Apache Gravitino \u003c 1.2.1 - Unauthenticated Remote Code Execution","Severity":"critical","Description":"Apache Gravitino \u003c 1.2.1 contains a remote code execution caused by unsanitized H2 JDBC URL via testConnection API using H2's INIT parameter, letting unauthenticated attackers execute arbitrary Java code remotely, exploit requires H2 usage.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-41042.yaml"}
{"ID":"CVE-2026-4106","Info":{"Name":"HT Mega \u003c 3.0.7 - Sensitive Information Disclosure","Severity":"high","Description":"The HT Mega plugin for WordPress is vulnerable to Sensitive Information Exposure via AJAX actions. This template dynamically extracts the security nonce before exploitation.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-4106.yaml"}
{"ID":"CVE-2026-41176","Info":{"Name":"Rclone RC - Broken Access Control","Severity":"critical","Description":"Rclone \u003e= 1.45.0 and \u003c 1.73.5 contains a broken access control vulnerability caused by unauthenticated access to the RC endpoint `options/set` allowing mutation of global runtime configuration, letting unauthenticated attackers access sensitive administrative functions, exploit requires RC server started without global HTTP authentication.\n","Classification":{"CVSSScore":"9.2"}},"file_path":"http/cves/2026/CVE-2026-41176.yaml"}
{"ID":"CVE-2026-41179","Info":{"Name":"RClone RC - Command Injection","Severity":"critical","Description":"Rclone \u003e= 1.48.0 and \u003c 1.73.5 contains an unauthenticated local command execution caused by unauthenticated access to the RC endpoint operations/fsinfo with attacker-controlled fs input, letting unauthenticated attackers execute local commands, exploit requires reachable RC deployment without global HTTP authentication.\n","Classification":{"CVSSScore":"9.2"}},"file_path":"http/cves/2026/CVE-2026-41179.yaml"}
{"ID":"CVE-2026-41432","Info":{"Name":"New API \u003c v0.12.10 - Stripe Webhook Bypass","Severity":"high","Description":"New API \u003c v0.12.10 contains a broken authentication caused by unauthenticated attacker forging Stripe webhook events, letting attackers credit arbitrary quota without payment, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.1"}},"file_path":"http/cves/2026/CVE-2026-41432.yaml"}
{"ID":"CVE-2026-41452","Info":{"Name":"Krayin CRM \u003c 2.2.1 - Installer Authentication Bypass","Severity":"critical","Description":"Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware caused by bypassing the CanInstall middleware redirect check via crafted HTTP POST requests, letting unauthenticated remote attackers overwrite the primary administrator account and gain full administrative access, exploit requires crafted HTTP POST with specific header.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-41452.yaml"}
{"ID":"CVE-2026-41456","Info":{"Name":"Bludit CMS \u003c= 3.20.0 - Cross-Site Scripting","Severity":"medium","Description":"Bludit CMS contains a reflected XSS caused by improper sanitization in the search plugin, letting unauthenticated attackers inject arbitrary JavaScript, exploit requires crafted malicious search query.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-41456.yaml"}
{"ID":"CVE-2026-41492","Info":{"Name":"Dgraph \u003c= 25.3.2 - Admin Token Disclosure","Severity":"critical","Description":"Dgraph \u003c= 25.3.2 contains an information disclosure caused by unauthenticated access to the /debug/vars endpoint , which publishes the cmdline variable including the --security token= flag, letting unauthenticated remote attackers retrieve the admin token and access admin-only endpoints, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-41492.yaml"}
{"ID":"CVE-2026-41640","Info":{"Name":"NocoBase - SQL Injection","Severity":"high","Description":"NocoBase versions prior to 2.0.39 contain a SQL injection vulnerability in the @nocobase/database package. The queryParentSQL function in eager-loading-tree.ts constructs a recursive CTE query by directly concatenating user-controlled primary key values into the SQL WHERE IN clause without parameterization. An authenticated attacker with record creation permissions on a tree collection with string-type primary keys can inject arbitrary SQL via crafted record identifiers, enabling full database compromise including data exfiltration and modification.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-41640.yaml"}
{"ID":"CVE-2026-41641","Info":{"Name":"NocoBase - SQL Injection","Severity":"high","Description":"NocoBase @nocobase/plugin-collection-sql versions prior to 2.0.39 are vulnerable to SQL injection via the sqlCollection:update endpoint. The checkSQL() function, which blocks dangerous SQL keywords and ensures only SELECT statements are allowed, is not called during collection updates.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2026/CVE-2026-41641.yaml"}
{"ID":"CVE-2026-41679","Info":{"Name":"Paperclip - Remote Code Execution","Severity":"critical","Description":"Paperclip \u003c 2026.416.0 contains a remote code execution caused by a chain of six unauthenticated API calls in authenticated mode with default configuration, letting unauthenticated attackers execute arbitrary code remotely, exploit requires network access to the target.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-41679.yaml"}
{"ID":"CVE-2026-41940","Info":{"Name":"cPanel \u0026 WHM - Authentication Bypass via Session-File CRLF Injection","Severity":"critical","Description":"cPanel and WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-41940.yaml"}
{"ID":"CVE-2026-41948","Info":{"Name":"Dify \u003c=1.14.1 - Unauthenticated Plugin Daemon Path Traversal","Severity":"critical","Description":"Dify version 1.14.1 and prior are affected by an unauthenticated path traversal in the Plugin Daemon icon proxy endpoint. The /console/api/workspaces/current/plugin/icon endpoint requires no authentication and passes the filename query parameter unsanitized into the internal Plugin Daemon REST API URL. Using ../ dot-sequence traversal an attacker escapes the authorized plugin/{tenant_id}/asset/ namespace and reaches arbitrary internal Plugin Daemon endpoints. The /health/check endpoint is always available and returns Plugin Daemon version, build time and pool status confirming exploitation.\n","Classification":{"CVSSScore":"9.4"}},"file_path":"http/cves/2026/CVE-2026-41948.yaml"}
{"ID":"CVE-2026-42018","Info":{"Name":"JFrog Artifactory - Anonymous Token Disclosure via Trailing Slash Auth Bypass","Severity":"high","Description":"JFrog Artifactory contains an information disclosure caused by returning an internal anonymous-user token to unauthenticated callers when anonymous access is disabled, letting unauthenticated attackers access sensitive resources. The exploit requires anonymous access to be disabled.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-42018.yaml"}
{"ID":"CVE-2026-42031","Info":{"Name":"CKAN DataStore SQL Search - SQL Injection","Severity":"high","Description":"CKAN, an open-source data management system used for powering open data portals, contains an unauthenticated SQL injection vulnerability in the datastore_search_sql API endpoint.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-42031.yaml"}
{"ID":"CVE-2026-42208","Info":{"Name":"LiteLLM - SQL Injection","Severity":"critical","Description":"LiteLLM 1.81.16 to \u003c 1.83.7 contains a SQL injection caused by improper handling of caller-supplied key in database query during proxy API key checks, letting unauthenticated attackers read and modify database data, exploit requires crafted Authorization header.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-42208.yaml"}
{"ID":"CVE-2026-42221","Info":{"Name":"Nginx UI \u003c= 2.3.7 - Unauthenticated Installer Exposure","Severity":"high","Description":"Nginx UI 2.0.0 to 2.3.8 contains an authentication bypass caused by unauthenticated access to /api/install during first-run setup, letting remote attackers claim the initial admin account, exploit requires attacker to access the service before legitimate operator.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2026/CVE-2026-42221.yaml"}
{"ID":"CVE-2026-42271","Info":{"Name":"LiteLLM - Command Injection","Severity":"critical","Description":"A critical unauthenticated remote code execution vulnerability exists in LiteLLM due to improper input handling in the MCP stdio test endpoint. An attacker can send a specially crafted request to the `/mcp-rest/test/connection` endpoint with controlled parameters, resulting in arbitrary command execution on the server. When combined with an authentication bypass technique—such as the Starlette BadHost flaw (CVE-2026-48710)—an unauthenticated attacker can exploit the chain to execute commands as the server process. Exploitation allows an attacker to spawn processes with the privileges of the LiteLLM server, potentially leading to complete compromise of the host.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-42271.yaml"}
{"ID":"CVE-2026-42281","Info":{"Name":"MagicMirror \u003c= 2.35.0 - Server-Side Request Forgery","Severity":"critical","Description":"An unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment variable placeholders (VAR_NAME), enabling exfiltration of server-side secrets.\n","Classification":{"CVSSScore":"9.2"}},"file_path":"http/cves/2026/CVE-2026-42281.yaml"}
{"ID":"CVE-2026-42461","Info":{"Name":"Arcane \u003c 1.18.0 - Unauthenticated Template and Env Disclosure","Severity":"high","Description":"Arcane \u003c 1.18.0 contains an information disclosure caused by missing authorization on /api/templates GET endpoints, letting unauthenticated network clients read sensitive Compose YAML and .env content, exploit requires network access\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-42461.yaml"}
{"ID":"CVE-2026-42564","Info":{"Name":"jotty.page \u003c 1.22.0 - Path Traversal","Severity":"high","Description":"jotty·page \u003c 1.22.0 contains a path traversal caused by lack of validation on filename parameter in /api/app-icons/[filename], letting unauthenticated attackers read arbitrary files outside intended directory.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2026/CVE-2026-42564.yaml"}
{"ID":"CVE-2026-42569","Info":{"Name":"phpVMS \u003c 7.0.6 - Legacy Importer Authorization Bypass","Severity":"critical","Description":"phpVMS \u003c 7.0.6 contains an authentication bypass caused by unauthenticated access to a legacy import feature, letting unauthenticated attackers access restricted functionality, exploit requires no special privileges.\n","Classification":{"CVSSScore":"9.4"}},"file_path":"http/cves/2026/CVE-2026-42569.yaml"}
{"ID":"CVE-2026-4257","Info":{"Name":"WordPress Contact Form by Supsystic - Server-Side Template Injection","Severity":"critical","Description":"Contact Form by Supsystic WordPress plugin \u003c= 1.7.36 contains a server-side template injection caused by unsandboxed Twig_Loader_String and cfsPreFill functionality, letting unauthenticated attackers execute arbitrary code remotely via GET parameters.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-4257.yaml"}
{"ID":"CVE-2026-42589","Info":{"Name":"Gotenberg - Command Injection","Severity":"critical","Description":"Gotenberg \u003c 8.31.0 contains a command injection caused by lack of validation on JSON metadata keys in /forms/pdfengines/metadata/write endpoint, letting unauthenticated attackers execute OS commands, exploit requires crafted HTTP request.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-42589.yaml"}
{"ID":"CVE-2026-42596","Info":{"Name":"Gotenberg \u003c 8.31.0 - Server-Side Request Forgery","Severity":"critical","Description":"Gotenberg before 8.31.0 is vulnerable to server-side request forgery (SSRF) due to insufficient validation of URLs in the downloadFrom API. An unauthenticated attacker can exploit the flaw by providing specially crafted IPv4-mapped IPv6 addresses (such as http://[::ffff:127.0.0.1]) that bypass the deny-list and allow access to internal resources. Fixed versions properly recognize these addresses and prevent such requests.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-42596.yaml"}
{"ID":"CVE-2026-42647","Info":{"Name":"JoomSport \u003c= 5.7.7 - SQL Injection","Severity":"critical","Description":"The JoomSport WordPress plugin through 5.7.7 is vulnerable to unauthenticated time-based blind SQL injection via the 'sortf' GET parameter in the player list view. The parameter value is backtick-wrapped and directly concatenated into an ORDER BY clause.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-42647.yaml"}
{"ID":"CVE-2026-42796","Info":{"Name":"Arelle \u003c 2.39.10 - Remote Code Execution","Severity":"critical","Description":"Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the webserver's /rest/configure endpoint. The plugins query parameter is forwarded to the plugin manager without authentication, allowing an attacker to supply a URL to a remote Python file that Arelle downloads and executes within its process.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-42796.yaml"}
{"ID":"CVE-2026-42878","Info":{"Name":"FacturaScripts - Unauthenticated phpinfo Disclosure","Severity":"medium","Description":"Detected FacturaScripts exposes a debug branch in the Installer controller that calls phpinfo() when the request carries the phpinfo=TRUE query parameter, and on an instance that has not finished installation, this endpoint was reachable without authentication.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-42878.yaml"}
{"ID":"CVE-2026-44177","Info":{"Name":"Kirby CMS 5.3.0-5.4.0 - Path Traversal","Severity":"high","Description":"Kirby CMS versions 5.3.0 through 5.4.0 are vulnerable to a path traversal vulnerability via the /api/auth/login endpoint. An unauthenticated attacker may supply a specially crafted email value in the request body containing traversal sequences (such as \"../..\"), which the application concatenates directly into a filesystem path when hydrating user objects. This can result in the resolution of paths outside the intended accounts directory and may lead to the inclusion of unintended files such as index.php, causing a denial of service by exhausting memory limits. The issue is addressed in version 5.4.1 by properly validating and sanitizing the user-supplied input to prevent directory traversal.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-44177.yaml"}
{"ID":"CVE-2026-44262","Info":{"Name":"Scramble Laravel - Remote Code Execution","Severity":"critical","Description":"Scramble for Laravel \u003e= 0.13.2 and \u003c 0.13.22 contains a remote code execution caused by evaluation of user-controlled input in validation rules during documentation generation, letting remote attackers execute arbitrary PHP code, exploit requires publicly accessible documentation endpoints.\n","Classification":{"CVSSScore":"9.4"}},"file_path":"http/cves/2026/CVE-2026-44262.yaml"}
{"ID":"CVE-2026-44338","Info":{"Name":"PraisonAI - Authentication Bypass","Severity":"high","Description":"PraisonAI 2.5.6 to \u003c 4.6.34 contains a broken authentication caused by disabled default authentication in legacy Flask API server, letting remote attackers access /agents and trigger workflows without token, exploit requires network access to API server.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2026/CVE-2026-44338.yaml"}
{"ID":"CVE-2026-44343","Info":{"Name":"WGDashboard \u003c 4.3.2 - Unauthenticated File Read","Severity":"critical","Description":"WGDashboard \u003c 4.3.2 contains a path traversal vulnerability caused by improper access control, letting unauthorized attackers access the host file system without authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-44343.yaml"}
{"ID":"CVE-2026-44381","Info":{"Name":"MISP \u003c 2.5.37 - SQL Injection","Severity":"medium","Description":"MISP before 2.5.37 is vulnerable to SQL injection via the order parameter in EventsController. The POST body order value is passed directly into ORDER BY clauses without validation.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-44381.yaml"}
{"ID":"CVE-2026-44551","Info":{"Name":"Open WebUI 'LDAP Empty Password' - Authentication Bypass","Severity":"critical","Description":"Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accepts password: str with no minimum length constraint, so an empty string passes validation. The subsequent Connection.bind() call succeeds on vulnerable LDAP servers, and the application issues a full session token for the target user. This vulnerability is fixed in 0.9.0.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-44551.yaml"}
{"ID":"CVE-2026-44825","Info":{"Name":"Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials","Severity":"high","Description":"Apache Solr 9.4.0 through 9.10.1 and 10.0.0 contain a hardcoded credentials vulnerability caused by default Basic Authentication template users in bin/solr auth enable, letting remote attackers gain full administrative access. Exploit requires use of default template users.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2026/CVE-2026-44825.yaml"}
{"ID":"CVE-2026-45298","Info":{"Name":"Dozzle - Server Side Request Forgery","Severity":"high","Description":"Dozzle prior to 10.5.2 contains a server-side request forgery caused by unauthenticated access to POST /api/notifications/test-webhook forwarding attacker-controlled URLs, letting remote attackers send arbitrary HTTP POST requests and receive response data, exploit requires no authentication.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2026/CVE-2026-45298.yaml"}
{"ID":"CVE-2026-45332","Info":{"Name":"Automad \u003c 2.0.0-beta.28 - Unauthenticated Admin Password Hash Disclosure","Severity":"high","Description":"Automad 2.0.0-alpha.1 to 2.0.0-beta.27 contains a broken access control vulnerability caused by publicly accessible /_api/user-collection/create-first-user endpoint returning full serialized user data, letting unauthenticated attackers retrieve bcrypt password hashes of all administrator accounts, exploit requires the endpoint to remain publicly accessible after initial setup.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-45332.yaml"}
{"ID":"CVE-2026-45397","Info":{"Name":"Open WebUI \u003c 0.9.5 - Information Disclosure","Severity":"medium","Description":"Open WebUI \u003c 0.9.5 contains an information disclosure vulnerability caused by unauthenticated access to GET /api/v1/retrieval/ endpoint, letting remote attackers retrieve live RAG pipeline configuration without authorization, exploit requires no authentication.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-45397.yaml"}
{"ID":"CVE-2026-45695","Info":{"Name":"Kopia Server 0.23.0 - Remote Code Execution","Severity":"critical","Description":"Kopia before version 0.23.0 allows unauthenticated remote code execution when started in server mode with the --without-password flag. When the /api/v1/repo/exists endpoint is exposed, it enables instantiation of the SFTP storage backend with user-supplied sshArguments. Due to improper argument parsing, an attacker may inject arbitrary SSH options such as -oProxyCommand, resulting in execution of arbitrary commands as the server process.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-45695.yaml"}
{"ID":"CVE-2026-4631","Info":{"Name":"Cockpit Web Console \u003c 360 - Remote Code Execution","Severity":"critical","Description":"Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-4631.yaml"}
{"ID":"CVE-2026-46339","Info":{"Name":"9Router \u003c= 0.4.36 - Unauthenticated RCE","Severity":"critical","Description":"9Router \u003c= 0.4.36 middleware only guards 8 explicitly listed routes, leaving /api/cli-tools/* and /api/mcp/* entirely unauthenticated. An attacker can POST to /api/cli-tools/cowork-settings to register a custom MCP plugin with attacker-controlled command and args stored verbatim into globalThis, then GET /api/mcp/{name}/sse to trigger spawn() with the stored command resulting in unauthenticated remote code execution.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-46339.yaml"}
{"ID":"CVE-2026-46364","Info":{"Name":"phpMyFAQ \u003c= 4.1.1 - SQL Injection","Severity":"critical","Description":"phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captcha endpoint by crafting malicious User-Agent headers to perform time-based blind SQL injection, extracting sensitive data including user credentials, admin tokens, and SMTP credentials from the database.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-46364.yaml"}
@@ -4121,14 +4278,21 @@
{"ID":"CVE-2026-47670","Info":{"Name":"DbGate - Remote Code Execution via Dynamic Import Bypass","Severity":"critical","Description":"DbGate versions \u003c= 7.1.8 are vulnerable to authenticated remote code execution via the POST /runners/load-reader endpoint. The functionName parameter is directly interpolated into a JavaScript code template without sanitization. The require=null mitigation is bypassed via dynamic import().\n","Classification":{"CVSSScore":"9.4"}},"file_path":"http/cves/2026/CVE-2026-47670.yaml"}
{"ID":"CVE-2026-47717","Info":{"Name":"FUXA 1.3.0 - Unauthenticated ICS/SCADA Project Data Disclosure","Severity":"high","Description":"FUXA v1.3.0 exposes full SCADA/HMI project configuration via GET /api/project without authentication, even when secureEnabled is true. The secureFnc middleware auto-generates\na valid guest JWT when no token is provided, bypassing authentication. Exposed data includes server-side scripts, device configs, HMI views, and alarm definitions.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-47717.yaml"}
{"ID":"CVE-2026-48030","Info":{"Name":"Pheditor 2.0.1-2.0.3 - OS Command Injection","Severity":"critical","Description":"Pheditor 2.0.1 to - 2.0.4 contains an OS command injection caused by improper sanitization of the 'dir' POST parameter in the terminal action handler, letting authenticated users execute arbitrary OS commands with web server privileges.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2026/CVE-2026-48030.yaml"}
{"ID":"CVE-2026-48048","Info":{"Name":"XWiki Platform - Password Hash Disclosure","Severity":"high","Description":"XWiki Platform is a generic wiki platform. The patch for GHSA-5cf8-vrr8-8hjm / CVE-2023-26476 was insufficient. Starting with version 6.2.1 and prior to 16.10.17, 17.4.9, 17.10.13, and 18.0.0RC1, slightly modified LiveTableResults parameters (for example password_class) still allow an unauthenticated attacker to discover password hashes one bit at a time. With about 768 requests, the full password salt and hash of a user can be retrieved. The check for password and email properties does not consider the class passed via the _class parameters.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-48048.yaml"}
{"ID":"CVE-2026-4810","Info":{"Name":"Google ADK-Python - Unauthenticated Builder Endpoint","Severity":"critical","Description":"Google Agent Development Kit (ADK) 1.7.0 through 1.28.1 and 2.0.0a1 through 2.0.0a2 on Python (OSS), Cloud Run, and GKE contains a code injection and missing authentication vulnerability, letting unauthenticated remote attackers execute arbitrary code on the server, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-4810.yaml"}
{"ID":"CVE-2026-48282","Info":{"Name":"Adobe ColdFusion - RDS Arbitrary File Write","Severity":"critical","Description":"ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. The RDS FILEIO WRITE operation allows unauthenticated attackers to write arbitrary files when RDS is enabled with authentication disabled. Exploitation of this issue does not require user interaction. Scope is changed.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-48282.yaml"}
{"ID":"CVE-2026-48313","Info":{"Name":"ColdFusion - Path Traversal","Severity":"high","Description":"ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read and limited write access. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-48313.yaml"}
{"ID":"CVE-2026-48558","Info":{"Name":"SimpleHelp \u003c=5.5.15 - OIDC JWT Authentication Bypass","Severity":"critical","Description":"SimpleHelp \u003c= 5.5.15 and 6.0 pre-release contain an authentication bypass caused by lack of cryptographic signature verification in OIDC tokens, letting remote unauthenticated attackers gain technician sessions, exploit requires OIDC authentication configured.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-48558.yaml"}
{"ID":"CVE-2026-48611","Info":{"Name":"phpBB \u003c 3.3.17 - Authentication Bypass","Severity":"critical","Description":"phpBB before 3.3.17 contains an authentication bypass vulnerability in the login-link feature. By setting the auth_provider query parameter to \"apache\", an unauthenticated attacker can bypass password verification and log in as any user, including administrators. The Apache auth provider trusts the Basic authentication header username without password verification, as it assumes Apache handles authentication upstream.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-48611.yaml"}
{"ID":"CVE-2026-48710","Info":{"Name":"Starlette - Improper Validation of Unsafe Equivalence in Input","Severity":"critical","Description":"A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP Host request header. This malformed header could cause the request.url to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on request.url for validation could be bypassed, potentially allowing unauthorized access or actions.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2026/CVE-2026-48710.yaml"}
{"ID":"CVE-2026-4883","Info":{"Name":"Piotnet Forms Pro \u003c= 2.1.40 - Unauthenticated Arbitrary File Upload RCE","Severity":"critical","Description":"Piotnet Forms WordPress plugin \u003c= 2.1.40 contains an unrestricted file upload vulnerability caused by incomplete file extension blacklist in 'piotnetforms_ajax_form_builder', letting unauthenticated attackers upload arbitrary files, exploit requires a file field in the form.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-4883.yaml"}
{"ID":"CVE-2026-48907","Info":{"Name":"Joomla! JCE extension \u003c 2.9.99.5 unauthenticated RCE","Severity":"critical","Description":"Joomla JCE editor extension contains an unrestricted file upload vulnerability caused by allowing unauthenticated users to create new editor profiles, letting attackers upload and execute PHP code remotely, exploit requires no authentication.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-48907.yaml"}
{"ID":"CVE-2026-48939","Info":{"Name":"Joomla iCagenda \u003c 3.9.10 - Unauthenticated Arbitrary File Upload RCE","Severity":"critical","Description":"iCagenda extension for Joomla contains an unrestricted file upload vulnerability in the file attachment feature, letting attackers upload and execute arbitrary PHP code, exploit requires no special privileges.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-48939.yaml"}
{"ID":"CVE-2026-49049","Info":{"Name":"JoomShaper Helix3 \u003c=3.1.0 - Unauthenticated Arbitrary JSON File Write","Severity":"high","Description":"JoomShaper Helix3 template framework versions 1.0 through 3.1.0 for Joomla expose an unauthenticated AJAX handler (plg_ajax_helix3) accessible via the Joomla com_ajax component. The onAjaxHelix3() plugin method processes data[action]=save requests without any authentication check or CSRF token validation. Unauthenticated remote attackers can write arbitrary JSON content to server-side files. The layoutName parameter contains no path traversal validation, enabling write to any directory writable by the web server process. Actively exploited in the wild by the AntonKill botnet campaign.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-49049.yaml"}
{"ID":"CVE-2026-49060","Info":{"Name":"Hippoo Mobile App for WooCommerce - Broken Access Control","Severity":"critical","Description":"Hippoo Mobile App for WooCommerce \u003c= 1.9.4 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-49060.yaml"}
{"ID":"CVE-2026-49069","Info":{"Name":"WPZOOM Portfolio \u003c= 1.4.21 - Reflected Cross-Site Scripting","Severity":"high","Description":"WPZOOM Portfolio \u003c= 1.4.21 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts in victim's browser, exploit requires crafted request.\n","Classification":{"CVSSScore":"7.1"}},"file_path":"http/cves/2026/CVE-2026-49069.yaml"}
{"ID":"CVE-2026-49468","Info":{"Name":"LiteLLM Proxy \u003c 1.84.0 - Host Header Authentication Bypass","Severity":"critical","Description":"LiteLLM Proxy before 1.84.0 derives its public-route authorization check from a URL reconstructed with the unvalidated Host header. A Host value containing a fragment can make a protected request appear to target the public root route, bypassing the API-key check. Version 1.84.0 derives the route from the raw ASGI path instead.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2026/CVE-2026-49468.yaml"}
{"ID":"CVE-2026-49772","Info":{"Name":"The Events Calendar 6.15.12 - 6.16.2 - Unauthenticated Blind SQL Injection","Severity":"critical","Description":"The Events Calendar WordPress plugin versions 6.15.12 through 6.16.2 do not properly validate the order parameter of the experimental tec/v1 REST events endpoint, allowing unauthenticated attackers to run blind SQL queries and extract arbitrary database contents.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-49772.yaml"}
{"ID":"CVE-2026-49777","Info":{"Name":"WordPress Product Slider Pro for WooCommerce \u003c 3.5.4 - Supply Chain Backdoor RCE","Severity":"critical","Description":"Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.4.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-49777.yaml"}
{"ID":"CVE-2026-4987","Info":{"Name":"SureForms \u003c= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via form_id","Severity":"high","Description":"The SureForms plugin for WordPress is vulnerable to payment amount validation bypass in versions up to, and including, 2.5.2.\nThe create_payment_intent AJAX handler checks `if ($form_id \u003e 0 \u0026\u0026 !empty($block_id))` before calling validate_payment_amount().\nBy sending form_id=0 (the default intval of a missing/zero value), an unauthenticated attacker completely skips the server-side\namount validation and can create Stripe payment intents with arbitrary amounts, bypassing configured pricing.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-4987.yaml"}
{"ID":"CVE-2026-49952","Info":{"Name":"Discuz! X5.0 - Authentication Bypass","Severity":"critical","Description":"Discuz! X5.0 20260320 through 20260501 contains an authentication bypass caused by exploitation of a shared cryptographic key and encryption oracle in dbbak.php and logging_ctl::logging_more(), letting unauthenticated remote attackers access database backup and restore functions, exploit requires crafted payload injection via username parameter.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-49952.yaml"}
@@ -4136,15 +4300,19 @@
{"ID":"CVE-2026-50229","Info":{"Name":"Apache Tomcat - Cross-Site Scripting","Severity":"medium","Description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-50229.yaml"}
{"ID":"CVE-2026-50230","Info":{"Name":"Lyrion Music Server \u003c= 9.2.0 - Cross-Site Scripting","Severity":"medium","Description":"Lyrion Music Server 9.2.0 contains a reflected XSS caused by improper sanitization of the search parameter in the server.log endpoint, letting unauthenticated attackers execute arbitrary script in users' browsers.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-50230.yaml"}
{"ID":"CVE-2026-5027","Info":{"Name":"Langflow \u003c= 1.8.4 - Path Traversal to RCE via File Upload","Severity":"high","Description":"The application contains a path traversal vulnerability caused by unsanitized 'filename' parameter in the 'POST /api/v2/files' multipart form data, letting attackers write files to arbitrary filesystem locations, exploit requires crafted request.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-5027.yaml"}
{"ID":"CVE-2026-5032","Info":{"Name":"W3 Total Cache \u003c= 2.9.3 - Unauthenticated Dynamic Security Token Disclosure","Severity":"high","Description":"The W3 Total Cache WordPress plugin through version 2.9.3 skips its entire output buffering and processing pipeline whenever an incoming request's User-Agent header contains the string \"W3 Total Cache\", without authenticating the caller. On sites that use developer-placed dynamic fragment tags, the raw mfunc/mclude HTML comments - which embed the per-site W3TC_DYNAMIC_SECURITY token - are therefore rendered directly into the page source instead of being processed and stripped, letting an unauthenticated attacker harvest the token by comparing a normal response against one sent with the magic User-Agent.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-5032.yaml"}
{"ID":"CVE-2026-5073","Info":{"Name":"WordPress ARMember Premium \u003c= 7.3.1 - Unauthenticated SQL Injection","Severity":"critical","Description":"The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'arm_directory_paging_action' AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied 'order' and 'orderby' parameters and the lack of sufficient preparation on the existing SQL query in the `arm_get_directory_members()` function.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-5073.yaml"}
{"ID":"CVE-2026-50751","Info":{"Name":"Check Point IKEv1 Remote-Access VPN - Certificate Authentication Bypass","Severity":"critical","Description":"IKEv1 key exchange contains a broken authentication caused by logic flow weakness in Remote Access and Mobile Access certificate validation, letting unauthenticated remote attackers bypass user authentication and establish VPN connections without valid passwords, exploit requires use of deprecated IKEv1.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-50751.yaml"}
{"ID":"CVE-2026-52715","Info":{"Name":"GEO my WP \u003c= 4.5.5 - Unauthenticated SQL Injection","Severity":"critical","Description":"The GEO my WP plugin for WordPress up to and including 4.5.5 does not sanitise the swlatlng and nelatlng map boundary parameters of its locator search form. The values are split on a comma and concatenated directly into the SQL query, allowing unauthenticated attackers to run blind SQL queries and extract arbitrary database contents.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-52715.yaml"}
{"ID":"CVE-2026-52773","Info":{"Name":"YesWiki Archived Revision - Cross-Site Scripting","Severity":"medium","Description":"YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append an XSS payload after a valid revision timestamp.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-52773.yaml"}
{"ID":"CVE-2026-52774","Info":{"Name":"YesWiki Bazar Widget - Reflected XSS via 'id' Parameter","Severity":"medium","Description":"YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using strip_tags() only. strip_tags() does not escape double quotes, allowing an attacker to break out of the data-formid attribute and inject arbitrary event handlers.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-52774.yaml"}
{"ID":"CVE-2026-52806","Info":{"Name":"Gogs \u003c= 0.14.2 - Authenticated RCE via git rebase Argument Injection","Severity":"critical","Description":"Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the \"Rebase before merging\" merge operation.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2026/CVE-2026-52806.yaml"}
{"ID":"CVE-2026-52815","Info":{"Name":"Gogs \u003c 0.14.3 - Unauthenticated Organization Teams Disclosure","Severity":"low","Description":"Gogs before version 0.14.3 contains an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint returns all teams for any organization without requiring authentication. The route group lacks the reqToken() middleware, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2026/CVE-2026-52815.yaml"}
{"ID":"CVE-2026-52824","Info":{"Name":"Kimai \u003c= 2.57.0 - Default APP_SECRET Authentication Bypass","Severity":"critical","Description":"Kimai Docker images \u003c= 2.57.0 ship with a hardcoded APP_SECRET of \"change_this_to_something_unique\". This default secret is used by Symfony's SignatureHasher to HMAC-sign login links and remember-me cookies. An unauthenticated attacker who knows this default secret can forge valid authentication tokens and hijack any user account, including the super-admin.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-52824.yaml"}
{"ID":"CVE-2026-53468","Info":{"Name":"Typemill CMS \u003c 2.23.0 - Cross-Site Scripting","Severity":"medium","Description":"Typemill CMS before version 2.23.0 is vulnerable to stored HTML attribute injection in the page metadata fields (og:title and og:description). An authenticated user with permission to modify page metadata can inject arbitrary HTML attributes into generated meta tags via the /api/v1/meta endpoint due to missing output encoding in the renderMeta() function in system/typemill/Assets.php.\n","Classification":{"CVSSScore":"4.6"}},"file_path":"http/cves/2026/CVE-2026-53468.yaml"}
{"ID":"CVE-2026-53519","Info":{"Name":"Nezha Dashboard \u003c 2.0.13 - Path Traversal","Severity":"critical","Description":"Nezha Monitoring \u003c 2.0.13 contains a path traversal caused by improper prefix checking in the dashboard's NoRoute handler, letting unauthenticated attackers read arbitrary files via crafted URLs.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-53519.yaml"}
{"ID":"CVE-2026-53576","Info":{"Name":"Kestra \u003c= 1.3.20 - Remote Code Execution","Severity":"critical","Description":"Kestra \u003c= 1.3.20 contains an authentication bypass caused by misclassification of /configs endpoint in REST API filter, letting unauthenticated attackers create and execute root-level tasks, exploit requires unauthenticated access to /configs endpoint.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-53576.yaml"}
{"ID":"CVE-2026-53595","Info":{"Name":"FreeScout \u003c 1.8.224 - Invite Hash Authorization Bypass","Severity":"critical","Description":"FreeScout prior to 1.8.224 contains an authentication bypass caused by improper invite_hash handling and decryption failure in user setup endpoint, letting anonymous attackers reset credentials and log in as the lowest-id activated user, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.4"}},"file_path":"http/cves/2026/CVE-2026-53595.yaml"}
{"ID":"CVE-2026-53629","Info":{"Name":"GLPI - Blind SQL Injection in History Log Filter (LogBleed)","Severity":"high","Description":"GLPI versions before 10.0.26 and 11.0.8 are vulnerable to a blind SQL injection in the history log filter. The Log::convertFiltersValuesToSqlCriteria() function splits the affected_fields filter into key:operator:value parts and DBmysqlIterator::analyseCrit() does not quote OR, AND and NOT as column names, allowing an authenticated user with logs READ right to inject arbitrary SQL. Verified against glpi/glpi:10.0.25 (Docker + MariaDB): filter \"OR::1 AND sleep(5)\" produces \"... AND (((((1 AND sleep(5))))))\" in the query and the request takes ~5s. On 10.0.26 the same payload is rejected (~30ms).\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-53629.yaml"}
{"ID":"CVE-2026-53753","Info":{"Name":"Crawl4AI \u003c= 0.8.6 - Remote Code Execution","Severity":"critical","Description":"Crawl4AI through 0.8.6 ships a Docker API server that exposes an unauthenticated /crawl endpoint. The computed field type of JsonCssExtractionStrategy evaluates a user supplied expression inside an AST based sandbox that does not restrict attribute access on generator frame objects. A generator expression can therefore reach gi_frame.f_back, walk the caller chain to f_builtins, recover __import__ and execute arbitrary operating system commands as the user running the container.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-53753.yaml"}
{"ID":"CVE-2026-53755","Info":{"Name":"crawl4ai \u003c 0.8.9 - Server Side Request Forgery","Severity":"high","Description":"Crawl4AI \u003c 0.8.9 contains a server-side request forgery caused by insufficient SSRF destination checks on proxy addresses in browser and crawler configurations, letting unauthenticated attackers access internal services and cloud metadata endpoints.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2026/CVE-2026-53755.yaml"}
@@ -4154,57 +4322,158 @@
{"ID":"CVE-2026-54069","Info":{"Name":"SiYuan Note \u003c= 3.6.5 - Authentication Bypass","Severity":"high","Description":"SiYuan Note 3.6.5 and prior is vulnerable to authentication bypass. The CheckAuth middleware unconditionally trusted all chrome-extension:// origins, granting RoleAdministrator access without token validation to any request with a spoofed Origin header. Fixed in v3.7.0.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-54069.yaml"}
{"ID":"CVE-2026-54157","Info":{"Name":"LobeHub LobeChat \u003c= 2.1.56 - Server-Side Request Forgery","Severity":"medium","Description":"LobeHub LobeChat versions up to and including 2.1.56 are vulnerable to an unauthenticated server-side request forgery vulnerability in the /webapi/proxy endpoint. The endpoint accepts a URL in the POST request body and fetches it server-side without authentication.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-54157.yaml"}
{"ID":"CVE-2026-54236","Info":{"Name":"vLLM \u003c= 0.23.0 - Anthropic Router Heap Address Information Leak","Severity":"medium","Description":"vLLM \u003c= 0.23.0 incompletely fixes CVE-2026-22778. The original fix added sanitize_message to the OpenAI router but the Anthropic-compatible router (/v1/messages) echoes str(exc) directly.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-54236.yaml"}
{"ID":"CVE-2026-54419","Info":{"Name":"PIAF-HMS ec.php - SQL Injection","Severity":"critical","Description":"claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commit 389d2633441b65ced1c104212cd62be2bfca21e5) contains multiple unauthenticated SQL injection vulnerabilities. The application has no authentication mechanism and passes user-supplied HTTP parameters directly into deprecated mysql_query calls via string concatenation, without sanitization, escaping, or parameterization.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-54419.yaml"}
{"ID":"CVE-2026-54617","Info":{"Name":"GravitLauncher LaunchServer \u003c=5.7.11 - Unauthenticated Path Traversal to Arbitrary File Read","Severity":"critical","Description":"LaunchServer's Netty FileServerHandler computes the served path by stripping one leading character on the assumption that every request-target begins with '/'. Netty's HttpServerCodec accepts a request-target without a leading slash verbatim, so a request without a leading slash bypasses path normalization and escapes the updatesDir. The file server is enabled by default (netty.fileServerEnabled=true) on 0.0.0.0:9274 with no authentication, allowing an unauthenticated remote GET to read any file readable by the LaunchServer process including its own ECDSA signing key (.keys/ecdsa_id), which signs access JWTs and enables full authentication bypass for any account.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-54617.yaml"}
{"ID":"CVE-2026-54836","Info":{"Name":"YMC Filter - SQL Injection","Severity":"critical","Description":"YMC Filter \u003c= 3.11.5 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-54836.yaml"}
{"ID":"CVE-2026-54917","Info":{"Name":"SeaweedFS \u003c= 4.29 - Path Traversal File Write","Severity":"high","Description":"SeaweedFS versions through 4.29 build the S3 API and Iceberg REST catalog routers with mux.NewRouter().SkipClean(true), which disables URL path cleaning. A `..` segment in the request path therefore survives routing and reaches the handlers unnormalised, so a request such as `PUT /bucket-A/../evil-bucket/key` is matched as bucket=bucket-A with object=../evil-bucket/key. The captured object key is then joined into a filer path where the `..` is collapsed server-side, so the write lands in evil-bucket while authorisation is evaluated against bucket-A, enabling cross-bucket file write.\n","Classification":{"CVSSScore":"7.8"}},"file_path":"http/cves/2026/CVE-2026-54917.yaml"}
{"ID":"CVE-2026-55087","Info":{"Name":"Etherpad 2.1.0 \u003c= 3.0.0 - Cross-Site Scripting","Severity":"medium","Description":"Etherpad versions 2.1.0 through 3.0.0 reflect the x-proxy-path request header into admin HTML, JavaScript, and CSS responses without sanitization. An attacker can abuse this behavior to inject crafted content into generated resource URLs, enabling cross-site scripting and cache poisoning scenarios.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-55087.yaml"}
{"ID":"CVE-2026-55224","Info":{"Name":"MineAdmin \u003c 3.2.0-alpha.2 - Plugin Path Traversal to RCE","Severity":"high","Description":"MineAdmin versions before 3.2.0-alpha.2 contain a path traversal vulnerability in the app-store plugin service. The identifier parameter is concatenated into filesystem paths without sanitization.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-55224.yaml"}
{"ID":"CVE-2026-55229","Info":{"Name":"Gotenberg \u003c 8.34.0 - Local File Disclosure","Severity":"high","Description":"Gotenberg before 8.34.0 allows SSRF and limited local file disclosure via its /forms/libreoffice/convert endpoint. When LibreOffice is used to convert user-uploaded DOCX files, external relationships within the document (such as a:blip r:link TargetMode=\"External\") can instruct LibreOffice to fetch local resources (file://) or remote resources (http/https), which are then included as images in the generated PDF. This can disclose the contents of local files LibreOffice can open as images, or allow outbound requests to attacker-controlled endpoints. Version 8.34.0 disables resolution of external resources during document conversion to mitigate the vulnerability.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-55229.yaml"}
{"ID":"CVE-2026-5524","Info":{"Name":"Divi Form Builder \u003c=5.1.8 - Unauthenticated Arbitrary File Upload RCE","Severity":"critical","Description":"The Divi Form Builder plugin for WordPress versions 5.1.8 and prior contains an unauthenticated arbitrary file upload vulnerability in the do_image_upload() AJAX handler. The user-controlled acceptFileTypes POST parameter is injected unsanitized into a PHP regex for file extension validation. By supplying acceptFileTypes=phtml the constructed regex accepts .phtml files while the plugin's .htaccess only blocks .php, so Apache executes .phtml files as PHP. The required nonce (fb_nonce) is publicly embedded in any page containing a Divi form via the de_fb_obj JavaScript object. Uploaded shells land in /wp-content/uploads/de_fb_uploads/. Fixed in 5.1.9.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-5524.yaml"}
{"ID":"CVE-2026-55450","Info":{"Name":"Langflow \u003c 1.9.1 - Unauthenticated File Upload","Severity":"critical","Description":"Langflow \u003c 1.9.1 contains an unrestricted file upload caused by lack of upload limitations, letting unauthenticated attackers exhaust server space and leak absolute file paths, exploit requires network access.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-55450.yaml"}
{"ID":"CVE-2026-55549","Info":{"Name":"Yamcs \u003c=5.8.6 - Cross-Site Scripting","Severity":"medium","Description":"Yamcs \u003c 5.9.4 contains a stored XSS caused by inadequate HTML escaping of attacker-controlled redirect_uri parameter in authorization template, letting attackers execute JavaScript to steal authentication data, exploit requires user to open crafted URL.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2026/CVE-2026-55549.yaml"}
{"ID":"CVE-2026-55552","Info":{"Name":"Yamcs \u003c=5.11.12 - Arbitrary File Read","Severity":"high","Description":"Yamcs through 5.11.12 serves static web resources through a handler that resolves the requested path against the configured web root without rejecting absolute paths. A request path that begins with a double slash is resolved as an absolute filesystem path, discarding the web root, and the handler returns the referenced file from the underlying host, letting unauthenticated attackers read any non-hidden file readable by the Yamcs service account whose path contains no dot segment.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-55552.yaml"}
{"ID":"CVE-2026-55592","Info":{"Name":"Dashy \u003c= 4.3.6 - Reflected XSS via Workspace","Severity":"medium","Description":"Dashy versions up to 4.3.6 contain a reflected cross-site scripting vulnerability in the workspace view. The url query parameter is passed directly to an iframe src attribute without scheme validation, allowing an attacker to inject javascript: URIs that execute arbitrary JavaScript in the context of the Dashy origin.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-55592.yaml"}
{"ID":"CVE-2026-5562","Info":{"Name":"Provectus kafka-ui \u003c=0.7.2 - Remote Code Execution","Severity":"critical","Description":"Provectus kafka-ui versions 0.7.0 through 0.7.2 are vulnerable to code injection in the `/api/smartfilters/testexecutions` endpoint. The `filterCode` parameter is evaluated as a Groovy expression without sandboxing, allowing an unauthenticated attacker to execute arbitrary code and operating-system commands on the host.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-5562.yaml"}
{"ID":"CVE-2026-55864","Info":{"Name":"GeoNetwork - Server-Side Request Forgery (SSRF)","Severity":"high","Description":"GeoNetwork versions 4.0.0 to 4.2.16 and 4.4.0 to 4.4.11 are vulnerable to an unauthenticated server-side request forgery (SSRF) in the SLD tool. The POST /srv/api/tools/ogc/sld endpoint accepts a caller-supplied WMS server URL and performs a server-side HTTP GetStyles request to it without any validation, allowing an anonymous attacker to make the server issue arbitrary outbound HTTP requests to internal services and read XML responses back.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2026/CVE-2026-55864.yaml"}
{"ID":"CVE-2026-56062","Info":{"Name":"Quotes llama \u003c= 3.1.5 - SQL Injection","Severity":"critical","Description":"Quotes llama 3.1.5 and earlier contains a time-based blind SQL injection vulnerability caused by improper control of a SQL identifier. The select_search() AJAX handler (registered for guests via wp_ajax_nopriv_select_search) reads the attacker-controlled 'sc' parameter from $_POST and substitutes it into the query through the malformed wpdb placeholder '%1s'.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-56062.yaml"}
{"ID":"CVE-2026-56070","Info":{"Name":"Advance Product Search \u003c= 1.4.4 - Unauthenticated Time-Based Blind SQL Injection","Severity":"critical","Description":"Advance Product Search 1.4.4 and earlier is vulnerable to unauthenticated time-based blind SQL injection. The plugin rebuilds the WordPress search SQL by hand and uses $wpdb-\u003eesc_like() which escapes LIKE wildcards but not single quotes, allowing injection through the ?s= parameter.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-56070.yaml"}
{"ID":"CVE-2026-5615","Info":{"Name":"VvvebJs \u003c= 2.0.5 - Cross-Site Scripting","Severity":"medium","Description":"Givanz Vvvebjs \u003c= 2.0.5 contains a stored XSS caused by manipulation of the \"uploadAllowExtensions\" argument in upload.php File Upload Endpoint, letting remote attackers execute scripts, exploit requires crafted input.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2026/CVE-2026-5615.yaml"}
{"ID":"CVE-2026-56265","Info":{"Name":"Crawl4AI \u003c 0.8.7 - Hardcoded JWT Signing Key Authentication Bypass","Severity":"critical","Description":"Crawl4AI Docker API server versions before 0.8.7 ship with a hardcoded default JWT signing key (\"mysecret\") used to sign and verify HS256 authentication tokens. Because the key is identical across every deployment where SECRET_KEY has not been overridden, an unauthenticated attacker can forge a valid Bearer token and use it to access every JWT-protected API endpoint (/md, /html, /screenshot, /pdf, /execute_js, /crawl, /ask).\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-56265.yaml"}
{"ID":"CVE-2026-56270","Info":{"Name":"Flowise \u003c= 3.0.13 - Unauthenticated OAuth Configuration Disclosure","Severity":"high","Description":"Flowise before 3.1.0 contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint, allowing unauthenticated remote attackers to retrieve an organization's complete SSO configuration including OAuth client secrets by providing an organizationId parameter.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-56270.yaml"}
{"ID":"CVE-2026-56290","Info":{"Name":"Page Builder CK \u003c= 3.5.10 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"Joomla Page Builder CK contains an unrestricted file upload vulnerability caused by lack of proper validation, letting unauthenticated attackers upload executable files and achieve remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-56290.yaml"}
{"ID":"CVE-2026-56291","Info":{"Name":"Balbooa Forms \u003c 2.4.1 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"Joomla Balbooa Forms contains an unrestricted file upload vulnerability caused by lack of authentication checks, letting unauthenticated attackers upload executable files and achieve remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-56291.yaml"}
{"ID":"CVE-2026-56292","Info":{"Name":"AcyMailing \u003c 10.11.1 - Unauthenticated SQL Injection","Severity":"critical","Description":"AcyMailing component for Joomla \u003c10.11.1 contains a sql injection caused by improper input sanitization, letting attackers access unauthorized database data, exploit requires crafted input.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-56292.yaml"}
{"ID":"CVE-2026-56681","Info":{"Name":"9router \u003c=0.5.4 - Authentication Bypass","Severity":"high","Description":"9Router prior to 0.5.6 contains an authentication bypass caused by trusting client-supplied X-9r-Real-Ip header in src/dashboardGuard.js, letting remote unauthenticated attackers access local API routes and consume resources, exploit requires bypassing API-key validation via header manipulation.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2026/CVE-2026-56681.yaml"}
{"ID":"CVE-2026-56782","Info":{"Name":"Gorse \u003c 0.5.10 - Unauthenticated Database Dump","Severity":"critical","Description":"Gorse \u003c 0.5.10 contains an authentication bypass caused by empty admin_api_key in /api/dump and /api/restore endpoints, letting unauthenticated remote attackers access and modify protected data, exploit requires default empty admin_api_key configuration.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-56782.yaml"}
{"ID":"CVE-2026-5718","Info":{"Name":"Drag and Drop Multiple File Upload - CF7 \u003c= 1.3.9.6 - Remote Code Execution","Severity":"critical","Description":"Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin \u003c= 1.3.9.6 contains an unrestricted file upload caused by insufficient file type validation and bypass of filename sanitization with non-ASCII characters, letting unauthenticated attackers upload arbitrary files and achieve remote code execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-5718.yaml"}
{"ID":"CVE-2026-57219","Info":{"Name":"RabbitMQ Management - OAuth 2 Client Secret Disclosure","Severity":"high","Description":"RabbitMQ \u003c 3.13.15, 4.0.20, 4.1.11, and 4.2.6 contains an information disclosure caused by the obsolete GET /api/auth endpoint exposing OAuth 2 client secrets when management.oauth_client_secret is configured, letting unauthenticated attackers access sensitive credentials, exploit requires management plugin and OAuth configuration enabled.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-57219.yaml"}
{"ID":"CVE-2026-57582","Info":{"Name":"GeoNetwork - Reflected Cross-Site Scripting","Severity":"high","Description":"GeoNetwork versions 4.4.5 through 4.4.11 are vulnerable to reflected cross-site scripting (XSS) in the public unauthenticated catalog search functionality. The uiconfig query parameter of the catalog.search endpoint is reflected into a JavaScript context without sufficient sanitization, allowing arbitrary JavaScript execution in a victim's browser.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2026/CVE-2026-57582.yaml"}
{"ID":"CVE-2026-57827","Info":{"Name":"RSFiles! for Joomla - Arbitrary File Upload","Severity":"critical","Description":"RSFiles! (com_rsfiles) for Joomla \u003c 1.17.12 allows unauthenticated arbitrary file upload via the rsfiles.upload task. The write method performs no authentication, CSRF token, or file extension checks, allowing upload of executable PHP files to the web-accessible downloads/ directory.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-57827.yaml"}
{"ID":"CVE-2026-58123","Info":{"Name":"Hermes WebUI \u003c 0.51.788 - Remote Code Execution","Severity":"critical","Description":"Hermes WebUI \u003c 0.51.788 contains an unauthenticated remote code execution caused by improper access control in embedded terminal API endpoints, letting remote attackers execute arbitrary shell commands without credentials.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-58123.yaml"}
{"ID":"CVE-2026-58138","Info":{"Name":"Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution","Severity":"critical","Description":"Orkes Conductor from 3.21.21 before 3.30.2 is vulnerable to unauthenticated remote code execution. The INLINE workflow task evaluates a user-supplied JavaScript expression in a GraalVM context created with HostAccess.ALL, so an unauthenticated attacker can reflect from the bound input object to java.lang.Runtime and execute arbitrary operating system commands through the workflow API.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-58138.yaml"}
{"ID":"CVE-2026-58191","Info":{"Name":"Appium base-driver \u003c=10.6.0 - Reflected Cross-Site Scripting","Severity":"medium","Description":"Appium \u003c= 10.7.0 contains a reflected XSS caused by unescaped reflection of throwError query parameter, comments POST field, and User-Agent header in base-driver routes, letting remote attackers execute arbitrary JavaScript, exploit requires crafted HTTP requests.\n","Classification":{"CVSSScore":"6.5"}},"file_path":"http/cves/2026/CVE-2026-58191.yaml"}
{"ID":"CVE-2026-58455","Info":{"Name":"Dockwatch \u003c= 0.6.567 - OS Command Injection","Severity":"critical","Description":"Dockwatch through 0.6.567 contains an unauthenticated command injection caused by missing exit() after authentication redirect in loader.php and unsanitized input in ajax/compose.php, letting remote attackers execute arbitrary shell commands, exploit requires seeding a session flag via incomplete auth check.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-58455.yaml"}
{"ID":"CVE-2026-58467","Info":{"Name":"Cockpit CMS \u003c= 2.14.0 - Path Traversal / Local File Inclusion","Severity":"high","Description":"Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion (LFI) vulnerability when executed under PHP's built-in CLI server (PHP_SAPI == 'cli-server') or non-normalizing reverse proxies. The application fails to sanitize dot-dot sequences in PATH_INFO routes starting with '/:' and containing '/storage/'. Unauthenticated remote attackers can traverse outside the designated directory to read arbitrary system files.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2026/CVE-2026-58467.yaml"}
{"ID":"CVE-2026-58644","Info":{"Name":"Microsoft SharePoint Server - WS-Federation BinaryFormatter Deserialization RCE","Severity":"critical","Description":"Microsoft SharePoint Server (2016, 2019, Subscription Edition \u003c= 2026.3.1) contains a remote code execution vulnerability in the WS-Federation passive sign-in endpoint (/_trust/default.aspx). The SharePoint authentication module (SPFederationAuthenticationModuleV2) uses a deflate-only DeflateCookieTransform (no MAC/signature check) to decode and BinaryFormatter to deserialize the SecurityContextToken Cookie value in the wresult parameter without type restrictions. An unauthenticated attacker can send a crafted WS-Federation token containing a BinaryFormatter gadget chain (DataSet + LosFormatter + XamlAssemblyLoadFromFile) to execute arbitrary code in the context of the IIS application pool identity (w3wp.exe). The fix (KB5002882, July 2026 CU) replaces the DeflateCookieTransform with\nNotSupportedCookieTransform, making ReadToken() throw before deserialization.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-58644.yaml"}
{"ID":"CVE-2026-59177","Info":{"Name":"ESPHome Device Builder \u003c1.0.10 - Unauthenticated Dashboard Access","Severity":"high","Description":"ESPHome Device Builder versions before 1.0.10 bind the trusted Home Assistant ingress site to all interfaces. A client that can reach the ingress port can therefore access the dashboard without the Supervisor's authentication proxy.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-59177.yaml"}
{"ID":"CVE-2026-59509","Info":{"Name":"cve-search 4.0-6.0.0 - Unauthenticated NoSQL Injection","Severity":"critical","Description":"cve-search versions 4.0 through 6.0.0 expose an unauthenticated DataTables endpoint that accepts attacker-controlled MongoDB collection, projection, filtering, and pagination parameters. This detector uses a harmless invalid projection field against the intended cves collection; version 6.0.1 rejects that field.\n","Classification":{"CVSSScore":"9.2"}},"file_path":"http/cves/2026/CVE-2026-59509.yaml"}
{"ID":"CVE-2026-59707","Info":{"Name":"LocalAI \u003c 4.6.0 - Server-Side Request Forgery","Severity":"critical","Description":"LocalAI before 4.6.0 is affected by an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint. The gallery `url` field is passed to the gallery config fetcher without validation, allowing an unauthenticated attacker to make the server issue HTTP requests to arbitrary internal, loopback, link-local, and cloud-metadata addresses. The outcome of the server-side fetch is reflected in the model-apply job status.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-59707.yaml"}
{"ID":"CVE-2026-59726","Info":{"Name":"ruflo MCP Bridge - Unauthenticated RCE via terminal_execute","Severity":"critical","Description":"ruflo MCP bridge (\u003c 3.16.3) in its default docker-compose deployment exposes POST /mcp with no authentication and binds to all interfaces (0.0.0.0:3001). The executeTool() function has no server-side deny list for dangerous tools, allowing an unauthenticated attacker to invoke tools/call with ruflo__terminal_execute, which runs execSync(command) on attacker-supplied input. This yields arbitrary command execution as the node user (uid 1000) inside the bridge container. The blocklist (AUTOPILOT_BLOCKED_PATTERNS + isBlockedTool()) is enforced only in the autopilot SSE handler; POST /mcp and POST /mcp/:group bypass it entirely.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-59726.yaml"}
{"ID":"CVE-2026-59774","Info":{"Name":"Gitea 1.22.1-1.27.0 - Unauthenticated Arbitrary File Read","Severity":"critical","Description":"Gitea versions 1.22.1 through 1.27.0 initialize the go-org markup renderer without replacing its default ReadFile callback. An unauthenticated attacker can submit Org-mode markup containing an #+INCLUDE directive with an absolute path to the repository markup endpoint of any public repository, causing the server to read and render arbitrary files accessible to the Gitea service user.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-59774.yaml"}
{"ID":"CVE-2026-59801","Info":{"Name":"9Router - Unauthenticated LLM Provider API Exposure","Severity":"critical","Description":"9Router through version 0.4.41 contains an unauthenticated access vulnerability caused by missing authentication middleware in Next.js API routes under src/app/api/providers/*, letting remote attackers enumerate, create, modify, or delete provider connections, exploit requires no authentication.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-59801.yaml"}
{"ID":"CVE-2026-60004","Info":{"Name":"Gitea \u003c= 1.27.0 - Pre-Auth Remote Code Execution","Severity":"critical","Description":"Gitea versions 1.17 through 1.27.0 contain a remote code execution vulnerability in the diffpatch endpoint caused by an add/add collision that writes an executable Git hook into the bare repository's GIT_DIR. An attacker with write access can execute arbitrary commands as the Gitea service account, exploit requires only open registration for unauthenticated access.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-60004.yaml"}
{"ID":"CVE-2026-60105","Info":{"Name":"Monsta FTP \u003c= 2.14.4 - Unauthenticated SSRF via IPv6 Blocklist Bypass","Severity":"high","Description":"Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2026/CVE-2026-60105.yaml"}
{"ID":"CVE-2026-6118","Info":{"Name":"AstrBot \u003c= 4.22.1 - Command Injection","Severity":"high","Description":"AstrBot versions up to and including 4.22.1 contain a command injection vulnerability in the MCP server configuration endpoint. The /api/tools/mcp/add endpoint accepts arbitrary command and args fields that are passed directly to subprocess execution during the connection test, without any validation or allowlist enforcement. An attacker with dashboard access can execute arbitrary system commands with AstrBot process privileges.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-6118.yaml"}
{"ID":"CVE-2026-61511","Info":{"Name":"vBulletin 6.x - Remote Code Execution","Severity":"critical","Description":"vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contain an eval injection vulnerability caused by insufficiently restrictive regex filtering in vB5_Template_Runtime::runMaths(), letting unauthenticated remote attackers execute arbitrary PHP code via the pagenav[pagenumber] parameter in ajax/render template route.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-61511.yaml"}
{"ID":"CVE-2026-61560","Info":{"Name":"GitLab MCP Server \u003c 2.1.27 - Unauthenticated SSE Transport Access","Severity":"critical","Description":"The @zereight/mcp-gitlab GitLab MCP server exposes its SSE transport endpoints without any authentication when SSE mode is enabled. An unauthenticated attacker with network access can establish an MCP session and invoke every registered tool, including upload_markdown, which reads arbitrary files from the server filesystem via an unsanitized file_path parameter.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-61560.yaml"}
{"ID":"CVE-2026-61736","Info":{"Name":"LightRAG \u003c= 1.5.3 - Credentialed CORS Wildcard","Severity":"high","Description":"LightRAG \u003c= 1.5.4 contains a broken access control vulnerability caused by default CORS_ORIGINS=* with allow_credentials=True in lightrag_server.py, letting malicious websites perform authenticated API requests, exploit requires authenticated user.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-61736.yaml"}
{"ID":"CVE-2026-61808","Info":{"Name":"LightRAG \u003c= 1.5.4 - Missing Authentication","Severity":"high","Description":"LightRAG through version 1.5.4 contains a broken access control vulnerability caused by the API server binding to all network interfaces with authentication disabled, letting unauthenticated network attackers fully control indexed documents and resources, exploit requires network access.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-61808.yaml"}
{"ID":"CVE-2026-6203","Info":{"Name":"User Registration \u0026 Membership WordPress plugin - Open Redirect","Severity":"medium","Description":"User Registration \u0026 Membership WordPress plugin \u003c= 5.1.4 contains an open redirect caused by insufficient validation of 'redirect_to_on_logout' parameter, letting attackers redirect users to malicious external URLs after logout, exploit requires crafted URL.\n","Classification":{"CVSSScore":"6.1"}},"file_path":"http/cves/2026/CVE-2026-6203.yaml"}
{"ID":"CVE-2026-62382","Info":{"Name":"PasswordPusher v1.45.11-v2.9.5 - Unauthenticated Anonymous Push Deletion via Ownership Bypass","Severity":"medium","Description":"PasswordPusher v1.45.11 through v2.9.5 allows unauthenticated deletion of anonymous pushes due to a nil==nil ownership-check bypass (CWE-863). The deletion guard evaluates (@push.user == current_user) || @push.deletable_by_viewer. For anonymous pushes, @push.user is nil; for unauthenticated requests, current_user is nil. Ruby evaluates nil==nil as true, so the ownership check passes and the deletable_by_viewer=false restriction is completely bypassed. Anyone who knows the secret URL token can permanently expire an anonymous push without any credentials.\n","Classification":{"CVSSScore":"6.9"}},"file_path":"http/cves/2026/CVE-2026-62382.yaml"}
{"ID":"CVE-2026-6279","Info":{"Name":"Avada Builder (fusion-builder) \u003c= 3.15.2 - Unauthenticated RCE via PHP Function Injection","Severity":"critical","Description":"The Avada Builder (fusion-builder) plugin for WordPress (versions \u003c= 3.15.2) is vulnerable to unauthenticated remote code execution via PHP function injection. The fusion_get_widget_markup AJAX action is registered for unauthenticated users (wp_ajax_nopriv_fusion_get_widget_markup) and is gated only by check_ajax_referer('fusion_load_nonce') - which validates nonce integrity, not user identity. That nonce is minted with wp_create_nonce() for user ID 0 and is deterministically inlined into the JavaScript (fusionPostCardsVars / fusionTableOfContentsVars, key \"nonce\") of any public page that renders a [fusion_post_cards] or [fusion_table_of_contents] shortcode. The attacker-controlled render_logics parameter is base64-decoded and JSON-decoded, and in the wp_conditional_tags case of Fusion_Builder_Conditional_Render_Helper::get_value() the decoded function and args are passed directly to call_user_func() with no allowlist, enabling arbitrary PHP function (and thus OS command) execution.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-6279.yaml"}
{"ID":"CVE-2026-63030","Info":{"Name":"WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion","Severity":"critical","Description":"WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to a pre-authentication route confusion issue in the REST API batch endpoint (/?rest_route=/batch/v1). A malformed nested batch request desynchronizes the batch router, allowing unauthenticated requests to reach unintended REST API handlers and bypass authorization checks. This route confusion can be chained with a SQL injection flaw (CVE-2026-60137) in the author_exclude parameter to extract database contents and ultimately achieve remote code execution. This template safely detects the vulnerable handler state via the route confusion behavior alone, without executing SQL or relying on response timing.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-63030.yaml"}
{"ID":"CVE-2026-63077","Info":{"Name":"JetBrains TeamCity \u003c 2026.1.3, 2025.11.7 - Remote Code Execution","Severity":"critical","Description":"JetBrains TeamCity \u003c 2026.1.3, 2025.11.7 contains a remote code execution caused by unauthenticated access via the agent polling protocol, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-63077.yaml"}
{"ID":"CVE-2026-63077","Info":{"Name":"JetBrains TeamCity \u003c 2026.1.3, 2025.11.7 - Remote Code Execution","Severity":"critical","Description":"JetBrains TeamCity \u003c 2026.1.3, 2025.11.7 contains a remote code execution caused by unsafe XStream deserialization in the unauthenticated agent polling protocol. The XStream instance serving /app/agents/v1 is created without NoTypePermission.NONE, so XStream's default type permissions (Throwable, Map and Collection hierarchies) remain in effect next to the TeamCity allowlist. An unauthenticated attacker registers an agent, obtains a TeamCity-AgentSessionId, and posts an XStream XML object graph to /app/agents/v1/commands/error that makes TeamCity write an attacker-controlled file into the webroot. This template writes an arithmetic-canary JSP (no OS command execution) and matches its evaluated output.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-63077.yaml"}
{"ID":"CVE-2026-63358","Info":{"Name":"FileGator \u003c 7.14.2 - Privilege Escalation","Severity":"high","Description":"FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.\n","Classification":{"CVSSScore":"7.3"}},"file_path":"http/cves/2026/CVE-2026-63358.yaml"}
{"ID":"CVE-2026-6377","Info":{"Name":"Next4Biz CSM - Arbitrary File Read via DownloadFileHandler","Severity":"high","Description":"Next4Biz CSM exposes the DownloadFileHandler.ashx endpoint, whose file parameter is passed to a path helper that never confirms the resolved path stays inside the upload directory before the file is streamed back. Because Path.Combine returns an absolute second argument verbatim, an unauthenticated attacker can supply an absolute Windows path and read any file the IIS application pool identity can open.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"http/cves/2026/CVE-2026-6377.yaml"}
{"ID":"CVE-2026-6433","Info":{"Name":"FlipperCode Custom CSS, JS \u0026 PHP \u003c= 2.0.7 - Remote Code Execution","Severity":"critical","Description":"Custom css-js-php WordPress plugin through 2.0.7 contains a command injection caused by unsanitized user input used in SQL query and passed to eval(), letting unauthenticated attackers execute arbitrary PHP code on the server.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-6433.yaml"}
{"ID":"CVE-2026-64638","Info":{"Name":"WordPress Core \u003c 7.0.3 - Preauth Reflected XSS (XSS2Shell)","Severity":"high","Description":"Pre-authentication reflected XSS in WordPress wp-login.php (CVE-2026-64638).\nThe flaw exploits a parser differential between PHP strip_tags() and\nWordPress KSES. Tags with whitespace after \u003c (e.g. \"\u003c area\") survive\nstrip_tags() but are normalized to valid HTML by KSES, leading to\nattacker-controlled DOM elements that trigger automatic JavaScript\nexecution via user-profile.js. No user interaction required.\nAffects all WordPress versions \u003c 7.0.3.\n","Classification":{"CVSSScore":"8.9"}},"file_path":"http/cves/2026/CVE-2026-64638.yaml"}
{"ID":"CVE-2026-64849","Info":{"Name":"MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypass","Severity":"critical","Description":"MLflow \u003e 3.15.0 contains an information disclosure vulnerability caused by improper validation of webhook URLs allowing attackers to reach internal or cloud metadata services and obtain response details, exploit requires unauthenticated access to the webhook test endpoint.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-64849.yaml"}
{"ID":"CVE-2026-6495","Info":{"Name":"WordPress Ajax Load More \u003c 7.8.4 - Reflected Cross-Site Scripting","Severity":"high","Description":"The Ajax Load More WordPress plugin \u003c 7.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting attack which could be used against high privilege users such as administrators.\n","Classification":{"CVSSScore":"7.1"}},"file_path":"http/cves/2026/CVE-2026-6495.yaml"}
{"ID":"CVE-2026-65442","Info":{"Name":"FormCraft3 \u003c= 3.9.15 - Server-Side Request Forgery","Severity":"high","Description":"Unauthenticated Server Side Request Forgery (SSRF) in FormCraft \u003c= 3.9.15 versions.\n","Classification":{"CVSSScore":"7.2"}},"file_path":"http/cves/2026/CVE-2026-65442.yaml"}
{"ID":"CVE-2026-65694","Info":{"Name":"Microweber CMS \u003c= 2.0.20 - Unauthenticated Arbitrary File Read","Severity":"high","Description":"Microweber CMS \u003c= 2.0.20 contains a path traversal vulnerability caused by failure to normalize path query parameter in static file controller, letting unauthenticated remote attackers read arbitrary files.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-65694.yaml"}
{"ID":"CVE-2026-65761","Info":{"Name":"Joomla Easy Store - SQL Injection","Severity":"critical","Description":"Joomla Easy Store extension 1.0.0-2.0.1 contains an unauthenticated SQL injection caused by improper validation of order parameters, letting unauthenticated attackers read the full database including credentials and sessions.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-65761.yaml"}
{"ID":"CVE-2026-65919","Info":{"Name":"Meshery \u003c1.0.57 - Arbitrary File Read","Severity":"high","Description":"Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in the file parameter to read arbitrary files from the host filesystem without authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-65919.yaml"}
{"ID":"CVE-2026-6639","Info":{"Name":"AI Copilot Content Generator \u003c=1.4.6 - Unauthenticated Task Data Exposure","Severity":"high","Description":"AIWU AI Chatbot \u0026 Workflow Automation WordPress plugin \u003c= 1.4.6 contains a sensitive information exposure caused by unauthenticated access to getCurrentTaskResults() method, letting unauthenticated attackers retrieve API keys and configuration data, exploit requires no authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-6639.yaml"}
{"ID":"CVE-2026-66914","Info":{"Name":"SEBLOD for Joomla \u003c 3.30.0/\u003c 4.7.0/\u003c 6.0.1 - Path Traversal","Severity":"critical","Description":"Joomla Extension SEBLOD \u003c 3.30.0, \u003c 4.7.0, \u003c 6.0.1 contains an unauthenticated path traversal caused by improper validation of file paths, letting unauthenticated attackers download files inside and outside the webroot, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.2"}},"file_path":"http/cves/2026/CVE-2026-66914.yaml"}
{"ID":"CVE-2026-67208","Info":{"Name":"Juggle \u003c= 1.6.0 - Unauthenticated Exposed H2 Database Console","Severity":"critical","Description":"Juggle ships the H2 database web console enabled and reachable from\nnon-localhost by default. No application-level authentication covers\nthe /h2-console path, and the shipped default datasource credentials\n(sa/juggle) are known. An unauthenticated remote attacker can reach the\nconsole and, using the default credentials, achieve OS command\nexecution on the host via the H2 CREATE ALIAS Runtime.exec() technique.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-67208.yaml"}
{"ID":"CVE-2026-6826","Info":{"Name":"Concrete CMS \u003c9.5.1 - Unauthenticated File Usage Disclosure","Severity":"medium","Description":"Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller.\n","Classification":{"CVSSScore":"6.9"}},"file_path":"http/cves/2026/CVE-2026-6826.yaml"}
{"ID":"CVE-2026-6854","Info":{"Name":"My Calendar \u003c 3.7.9 - Unauthenticated SQL Injection","Severity":"high","Description":"The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'mc_auth' parameter in all versions up to, and including, 3.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-6854.yaml"}
{"ID":"CVE-2026-6875","Info":{"Name":"ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE","Severity":"critical","Description":"ServiceNow AI Platform (Brazil, Australia, Zurich, and Yokohama releases before patching) contains a pre-authentication remote code execution vulnerability. The /assessment_thanks.do endpoint passes the sysparm_assessable_type parameter into GlideRecord's addQuery(), which evaluates \"javascript:\" prefixed values as JavaScript in a restricted script sandbox. A sandbox escape gadget using Object.defineProperty and Class.create.constructor chains through the gs.include('ItemViewElementsProvider') path to invoke Function(code)(), bypassing the sandbox and executing arbitrary GlideController code. Actively exploited in the wild since July 2026.\n","Classification":{"CVSSScore":"9.5"}},"file_path":"http/cves/2026/CVE-2026-6875.yaml"}
{"ID":"CVE-2026-69084","Info":{"Name":"SiYuan - SQL Execution","Severity":"critical","Description":"SiYuan \u003c= v3.7.2 contains a SQL injection caused by passing client-supplied SQL statements verbatim to the main read-write database handle in /api/search/searchEmbedBlock, letting attackers with publish RoleReader token or anonymous access read and modify content, exploit requires publish RoleReader token or disabled publish authentication.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2026/CVE-2026-69084.yaml"}
{"ID":"CVE-2026-69085","Info":{"Name":"SiYuan \u003c=3.7.2 - SQL Injection","Severity":"critical","Description":"SiYuan before v3.7.3 contains a SQL injection caused by direct concatenation of the keyword parameter in /api/filetree/searchDocs endpoint, letting attackers with publish RoleReader token or unauthenticated in publish mode read and modify database content.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2026/CVE-2026-69085.yaml"}
{"ID":"CVE-2026-69137","Info":{"Name":"SuiteCRM \u003c= 7.15.1, \u003c= 8.10.1 - Authenticated SSRF","Severity":"high","Description":"SuiteCRM CalendarAccount testConnection accepts an attacker-controlled server_url and passes it to cURL without destination validation. An authenticated user can cause a server-side request to loopback or internal network services.\n","Classification":{"CVSSScore":"7.7"}},"file_path":"http/cves/2026/CVE-2026-69137.yaml"}
{"ID":"CVE-2026-69251","Info":{"Name":"Flowise \u003c 3.1.3 - Remote Code Execution","Severity":"critical","Description":"Flowise prior to 3.1.3 contains a remote code execution vulnerability caused by allowing authenticated users to set arbitrary TypeORM DataSource options including entities that load local JavaScript files, letting authenticated users execute arbitrary code on the server, exploit requires user authentication.\n","Classification":{"CVSSScore":"9.0"}},"file_path":"http/cves/2026/CVE-2026-69251.yaml"}
{"ID":"CVE-2026-71209","Info":{"Name":"Audiobookshelf - Authentication Bypass","Severity":"critical","Description":"Audiobookshelf contains a path traversal caused by improper authentication-exemption check on URL-encoded paths in server/routers/Auth.js, letting unauthenticated attackers read arbitrary files, exploit requires crafted URL with encoded traversal sequences.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-71209.yaml"}
{"ID":"CVE-2026-71362","Info":{"Name":"Adobe Commerce/Magento - Customer Session Identity Switch","Severity":"critical","Description":"Adobe Commerce contains an incorrect authorization vulnerability caused by improper access control, letting attackers escalate privileges to access sensitive resources, exploit requires no user interaction.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-71362.yaml"}
{"ID":"CVE-2026-72867","Info":{"Name":"Dokploy \u003c= 0.29.12 - Authenticated RCE via Command Injection","Severity":"critical","Description":"Dokploy \u003c= 0.29.12 is vulnerable to authenticated OS command injection through the customGitBranch field of a compose service. The value is concatenated unsanitized into git clone --branch \u003ccustomGitBranch\u003e ... and executed via /bin/sh during deploy (packages/server/src/utils/providers/git.ts -\u003e child_process.exec). An authenticated user can inject shell metacharacters to achieve remote code execution on the Dokploy host.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2026/CVE-2026-72867.yaml"}
{"ID":"CVE-2026-72898","Info":{"Name":"Metabase - Unauthenticated SQL Injection","Severity":"critical","Description":"Metabase contains a sql injection caused by improper sanitization of input in the '/reset_password' database endpoint, letting remote unauthenticated attackers gain administrator access, exploit requires no special privileges.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-72898.yaml"}
{"ID":"CVE-2026-73034","Info":{"Name":"DB-GPT \u003c= 0.8.1 - Arbitrary File Write","Severity":"critical","Description":"DB-GPT through 0.8.1 allows unauthenticated arbitrary file writes via a path traversal in the user_id HTTP header of the POST /api/v1/python/file/upload endpoint, letting attackers escape the intended upload directory and write files anywhere, as confirmed by the reflected upload path in the JSON response.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-73034.yaml"}
{"ID":"CVE-2026-7467","Info":{"Name":"Read More \u0026 Accordion \u003c= 3.5.7 - Authenticated Privilege Escalation","Severity":"high","Description":"The Read More \u0026 Accordion (expand-maker) plugin for WordPress through 3.5.7 allows privilege escalation due to improper validation in the importData AJAX handler (yrm_import_data action). An authenticated user with plugin access can upload a crafted JSON attachment to insert arbitrary rows into WordPress database tables, including those that control user roles and capabilities, potentially leading to site takeover.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-7467.yaml"}
{"ID":"CVE-2026-75128","Info":{"Name":"Langchain-Chatchat \u003c= 0.3.1.3 - Unauthenticated RCE","Severity":"critical","Description":"Langchain-Chatchat \u003c= 0.3.1.3 contains a command injection caused by unauthenticated access to the /tools/call API endpoint invoking the shell tool, letting remote attackers execute arbitrary OS commands as root, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-75128.yaml"}
{"ID":"CVE-2026-75650","Info":{"Name":"Adobe Commerce/Magento \u003c= 2.4.9 - StyleSmuggler Unauthenticated RCE via SSTI","Severity":"critical","Description":"Adobe Commerce contains a template injection caused by improper neutralization of special elements in the template engine, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-75650.yaml"}
{"ID":"CVE-2026-76268","Info":{"Name":"Splunk Enterprise Patroni REST API - Missing Authentication RCE","Severity":"critical","Description":"Splunk Enterprise versions 10.2.0 through 10.2.6 and 10.4.0 through 10.4.2 expose the Patroni REST API (PostgreSQL sidecar) on SHC members without authentication. An unauthenticated attacker can PATCH /config to set a malicious archive_command and POST /restart to trigger it, achieving remote code execution with the privileges of the PostgreSQL process via the classic Patroni RCE chain.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-76268.yaml"}
{"ID":"CVE-2026-76460","Info":{"Name":"Cisco Identity Services Engine - ise-kong API Gateway Authentication Bypass","Severity":"critical","Description":"Cisco Identity Services Engine contains an authentication bypass caused by insufficient authentication control on an API endpoint, letting unauthenticated remote attackers gain unauthorized access, exploit requires crafted request to API endpoint.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2026/CVE-2026-76460.yaml"}
{"ID":"CVE-2026-76904","Info":{"Name":"GeoServer jsonArrayContains CQL Filter - SQL Injection","Severity":"critical","Description":"GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoTools FilterToSqlHelper.constructEquality writes the expected argument of the jsonArrayContains CQL function RAW into the SQL string while only escaping the JSON pointer. A single quote in the value parameter breaks out of the PostgreSQL jsonb_path_exists string literal, enabling unauthenticated SQL injection. When the PostGIS backend runs with superuser privileges, the injection escalates to operating system command execution through PostgreSQL COPY TO PROGRAM. Patches are available in GeoTools 33.6 and 34.5. No known workaround is available, so the scope can only be limited by restricting which CQL functions are exposed.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-76904.yaml"}
{"ID":"CVE-2026-77806","Info":{"Name":"SPIP \u003c 4.4.22 - Unauthenticated RCE","Severity":"critical","Description":"SPIP \u003c 4.4.21 contains a remote code execution caused by mishandling of the X-Spip-Filtre HTTP request header in analyse_resultat_skel, letting unauthenticated remote attackers execute arbitrary code.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-77806.yaml"}
{"ID":"CVE-2026-7798","Info":{"Name":"WordPress FluentCRM \u003c= 2.9.87 - Unauthenticated Blind SSRF","Severity":"medium","Description":"FluentCRM WordPress plugin \u003c= 2.9.87 contains a blind server-side request forgery caused by improper validation of the 'SubscribeURL' parameter, letting unauthenticated attackers make arbitrary web requests, exploit requires unconfigured SES bounce handling key.\n","Classification":{"CVSSScore":"5.4"}},"file_path":"http/cves/2026/CVE-2026-7798.yaml"}
{"ID":"CVE-2026-7873","Info":{"Name":"Langflow 1.7.2-1.10.0 - Authenticated Remote Code Execution","Severity":"critical","Description":"IBM Langflow OSS 1.0.0 through 1.10.0 contains a command injection caused by insufficient input validation, letting authenticated attackers execute arbitrary OS commands and read sensitive files, exploit requires authentication.\n","Classification":{"CVSSScore":"9.9"}},"file_path":"http/cves/2026/CVE-2026-7873.yaml"}
{"ID":"CVE-2026-80099","Info":{"Name":"Newfold WordPress Plugins - Unauthenticated Admin Bypass via Empty HMAC Secret","Severity":"high","Description":"Newfold Digital WordPress plugins bundling wp-module-data \u003c=2.9.4 allow unauthenticated attackers to forge a valid Bearer token and gain WordPress administrator access. The authenticate() method (hooked on rest_authentication_errors) computes: token = sha256(sha256(wp_json_encode({method,url,body,timestamp})) + sha256(strrev(get_auth_token()))) On sites not connected to Hiive, get_auth_token() returns false; PHP coerces strrev(false) to strrev('') = '', so the HMAC salt collapses to the public constant sha256('') = e3b0c44... All other inputs are attacker-controlled, enabling offline token forgery without any secret knowledge.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-80099.yaml"}
{"ID":"CVE-2026-8037","Info":{"Name":"Progress ADC LoadMaster - Command Injection","Severity":"critical","Description":"OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-8037.yaml"}
{"ID":"CVE-2026-80462","Info":{"Name":"Chef Automate API Gateway - Authentication Bypass","Severity":"critical","Description":"Chef Automate derives an internal service identity from an X.509 certificate supplied in a request header without verifying its issuer. The load balancer blanks X-Client-Cert but does not strip the Grpc-Metadata- prefixed variants, which grpc-gateway rewrites into the metadata key the gateway's auth middleware reads. A remote unauthenticated attacker can present a self-signed certificate naming an internal service such as deployment-service and be authenticated as that service.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2026/CVE-2026-80462.yaml"}
{"ID":"CVE-2026-8054","Info":{"Name":"dotCMS Core Publish Audit API - Unauthenticated SQL Injection","Severity":"critical","Description":"dotCMS Core 25.11.04-1 through 26.04.28-02 contains an SQL injection caused by unsanitized input in Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll), letting remote unauthenticated attackers read, modify, or destroy arbitrary database content, exploit requires no authentication.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-8054.yaml"}
{"ID":"CVE-2026-8089","Info":{"Name":"WordPress weMail \u003c 2.1.3 - Cross-Site Scripting","Severity":"high","Description":"The weMail plugin for WordPress \u003c 2.1.3 is vulnerable to reflected cross-site scripting. The plugin does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected AJAX response.\n","Classification":{"CVSSScore":"7.1"}},"file_path":"http/cves/2026/CVE-2026-8089.yaml"}
{"ID":"CVE-2026-81199","Info":{"Name":"MasterStudy LMS \u003c 3.7.46 - Unauthenticated Student Statistics Disclosure","Severity":"medium","Description":"MasterStudy LMS WordPress plugin before 3.7.46 contains an information disclosure vulnerability caused by missing authorization checks in student learning statistics, letting unauthenticated attackers access sensitive user course data, exploit requires no authentication.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-81199.yaml"}
{"ID":"CVE-2026-81578","Info":{"Name":"PaperCut NG/MF \u003c=26.0.4 - Unauthenticated ConfigEditor Access via Tapestry Complex-Direct","Severity":"critical","Description":"PaperCut NG and PaperCut MF versions 24.x through 26.x contain an authentication bypass vulnerability in the Apache Tapestry-based web interface. By crafting a complex-direct service request that specifies the public Home page as the render target while invoking the privileged ConfigEditor page's form listeners, an unauthenticated remote attacker can search and modify server configuration options. PaperCut's access control validates the render page but fails to validate the component page, allowing full configuration access without authentication. When chained with CVE-2026-82078, an attacker reconfigures external user lookup to use a malicious JDBC URL whose initialization SQL evaluates arbitrary Groovy code, achieving unauthenticated remote code execution. This vulnerability is actively exploited in the wild.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-81578.yaml"}
{"ID":"CVE-2026-8181","Info":{"Name":"WordPress Burst Statistics 3.4.0-3.4.1.1 - Authentication Bypass","Severity":"critical","Description":"Burst Statistics – Privacy-Friendly WordPress Analytics plugin 3.4.0 to 3.4.1.1 contains an authentication bypass caused by incorrect return-value handling in is_mainwp_authenticated() function, letting unauthenticated attackers impersonate administrators, exploit requires knowledge of an administrator username.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-8181.yaml"}
{"ID":"CVE-2026-82186","Info":{"Name":"WordPress WPLP Cookie Consent \u003c 4.4.2 - SQL Injection","Severity":"medium","Description":"The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to execute arbitrary SQL commands.\n","Classification":{"CVSSScore":"4.1"}},"file_path":"http/cves/2026/CVE-2026-82186.yaml"}
{"ID":"CVE-2026-82222","Info":{"Name":"GiveWP \u003c= 4.16.7.1 - Remote Code Execution","Severity":"critical","Description":"GiveWP \u003c= 4.16.7.1 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection remotely, exploit requires crafted input\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-82222.yaml"}
{"ID":"CVE-2026-82329","Info":{"Name":"JFrog Artifactory Access Blank Join Key Authentication Bypass","Severity":"critical","Description":"JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-82329.yaml"}
{"ID":"CVE-2026-8236","Info":{"Name":"Concrete CMS \u003c9.5.1 - Unauthenticated File-Usage Internal Metadata Disclosure","Severity":"medium","Description":"Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system/dialogs/file/usage/{fID} accepts an integer file ID in the URL and returns internal site structure data (page IDs, versions, URL paths) to anyone who sends a GET request.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-8236.yaml"}
{"ID":"CVE-2026-8237","Info":{"Name":"Concrete CMS \u003c= 9.5.0 - Unauthenticated Conversation Message Disclosure (IDOR)","Severity":"medium","Description":"Concrete CMS \u003c= 9.5.0 contains an IDOR caused by insufficient access control in /ccm/frontend/conversations/message_detail endpoint, letting unauthenticated attackers enumerate conversation messages and attachments.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-8237.yaml"}
{"ID":"CVE-2026-82456","Info":{"Name":"argocd-mcp 0.8.0 - Unauthenticated MCP Session and Tool Access","Severity":"critical","Description":"argocd-mcp before 0.9.0 binds its MCP HTTP listener to all interfaces without requiring authentication. A remote unauthenticated attacker can initialize an MCP session, complete the handshake, and enumerate or invoke the full Argo CD tool surface using the operator's stored API token.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2026/CVE-2026-82456.yaml"}
{"ID":"CVE-2026-82901","Info":{"Name":"Ultimate Addons for Contact Form 7 \u003c= 3.5.50 - Arbitrary File Upload","Severity":"high","Description":"Ultimate Addons for Contact Form 7 (UACF7) \u003c= 3.5.50 copies every file submitted through a Contact Form 7 [uacf7_signature] field into wp-content/uploads/uacf7-uploads/ with no file-type or extension validation when the PDF Generator module is enabled on the form. An unauthenticated attacker can POST to the public CF7 REST feedback endpoint and write an arbitrary file of any extension into the webroot (CWE-434). The written file is directly retrievable without authentication. The copy sink is addons/pdf-generator/pdf-generator.php, which stores the file as \"{time()}-{field_name}-{sanitize_file_name(basename)}\". Fixed in 3.5.51, which adds uacf7_is_safe_uploaded_file() with a MIME/extension allowlist.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2026/CVE-2026-82901.yaml"}
{"ID":"CVE-2026-8383","Info":{"Name":"LearnPress \u003c 4.3.7 - Information Disclosure","Severity":"medium","Description":"LearnPress WordPress plugin \u003c 4.3.7 contains an information disclosure vulnerability caused by missing capability checks on a REST endpoint, letting unauthenticated visitors retrieve sensitive user role and capability data via crafted requests.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-8383.yaml"}
{"ID":"CVE-2026-8385","Info":{"Name":"WordPress WP Go Maps \u003c 10.0.10 - Unauthenticated Marker Data Disclosure","Severity":"medium","Description":"WP Go Maps WordPress plugin \u003c 10.0.10 contains an information disclosure vulnerability caused by improper enforcement of marker approval filter in admin-ajax fallback for datatables route, letting unauthenticated visitors retrieve unapproved marker records.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-8385.yaml"}
{"ID":"CVE-2026-8386","Info":{"Name":"WP Go Maps \u003c 10.0.10 - Unauthenticated Marker Information Disclosure","Severity":"medium","Description":"WP Go Maps WordPress plugin \u003c10.0.10 contains an information disclosure vulnerability caused by lack of approval-state filtering on the public single-marker REST endpoint, letting unauthenticated users access unapproved marker records including PII and geographic coordinates, exploit requires no authentication.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-8386.yaml"}
{"ID":"CVE-2026-84434","Info":{"Name":"WordPress Gravity Forms Plugin \u003c=3.1.0.4 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"Gravity Forms WordPress plugin version 3.1.0.4 and earlier contains an unauthenticated arbitrary file upload vulnerability caused by bypassing extension validation in hidden file upload fields. Unauthenticated attackers can upload any file type including PHP when a form has a File Upload field configured with Hidden visibility. The bypass works because the server-side extension validation is skipped for fields with gfield_visibility_hidden CSS class.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-84434.yaml"}
{"ID":"CVE-2026-85097","Info":{"Name":"Bricksforge WordPress Plugin \u003c=3.1.8.9 - Unauthenticated Arbitrary File Upload","Severity":"critical","Description":"Bricksforge WordPress plugin versions up to and including 3.1.8.9 are vulnerable to unauthenticated arbitrary file upload leading to remote code execution. An attacker obtains a wp_rest nonce via the bricksforge_regenerate_nonce AJAX action, uploads a GIF/PHP polyglot through the form_file_upload REST endpoint with the nonce in the X-WP-Nonce header, then triggers form_submit to copy the file to the WordPress media uploads directory where it executes as PHP. Requires a published Bricks Pro Form with a file field on the target; the post_id, form_id, and field_id template variables must be set accordingly.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-85097.yaml"}
{"ID":"CVE-2026-85200","Info":{"Name":"GEO my WP \u003c=4.5.5.3 - Unauthenticated Local File Inclusion","Severity":"high","Description":"GEO my WP WordPress plugin \u003c= 4.5.5.3 contains a local file inclusion caused by improper handling in gmw_posts_locator_ajax_info_window_loader function, letting unauthenticated attackers execute arbitrary PHP code remotely.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-85200.yaml"}
{"ID":"CVE-2026-85595","Info":{"Name":"Traefik \u003c 2.11.55 / 3.0.0 - 3.7.10 - Digest Authentication Bypass","Severity":"critical","Description":"Traefik \u003c 2.11.55 contains an authentication bypass caused by digestAuth middleware returning empty secret for unknown usernames, letting attackers bypass authentication on digestAuth-protected routes without valid credentials.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-85595.yaml"}
{"ID":"CVE-2026-85688","Info":{"Name":"TEN Framework - Arbitrary File Read \u0026 Write","Severity":"critical","Description":"TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints, letting attackers read or write arbitrary files and execute code. The exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-85688.yaml"}
{"ID":"CVE-2026-85706","Info":{"Name":"GitLab CE/EE \u003c=19.1.7/19.2.5/19.3.1 - Arbitrary File Read","Severity":"critical","Description":"GitLab CE/EE contains an unauthenticated arbitrary file read. Workhorse, the reverse proxy in front of Rails, matches upload routes using EscapedPath() and path.Clean without decoding percent sequences, while Puma decodes them before routing to Grape. Appending a trailing slash to commits or percent-encoding a static path segment as %63ommits therefore bypasses Workhorse upload route rewriting, and Rails reaches file_params_from_body_upload() which opens the path given in the file.path parameter before authenticate! is enforced. On the application/x-www-form-urlencoded branch the file bytes are handed to Rack::Utils.parse_nested_query, and any invalid percent sequence raises an ArgumentError whose message is interpolated into the HTTP 400 response body, disclosing file content to an unauthenticated caller.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-85706.yaml"}
{"ID":"CVE-2026-85714","Info":{"Name":"Stirling PDF \u003c= 2.13.1 - H2 Database Import Remote Code Execution","Severity":"critical","Description":"Stirling-PDF \u003c 2.13.2 contains a command injection caused by insufficient SQL whitelist validation in DatabaseService.validateSqlContent(), letting authenticated administrators execute arbitrary OS commands via crafted SQL files, exploit requires admin authentication and default H2 database with security mode.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-85714.yaml"}
{"ID":"CVE-2026-86206","Info":{"Name":"N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing","Severity":"critical","Description":"A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-86206.yaml"}
{"ID":"CVE-2026-86207","Info":{"Name":"N-able N-central - Authentication Bypass","Severity":"critical","Description":"An authentication bypass in N-central \u003c 2026.3 HF 3 leads to authentication bypass in internal-only APIs.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-86207.yaml"}
{"ID":"CVE-2026-86218","Info":{"Name":"N-able N-central \u003c2026.3.1.14 - Pre-Authentication Remote Code Execution","Severity":"critical","Description":"N-able N-central versions before 2026.3.1.14 are vulnerable to pre-authentication remote code execution via static code injection (CWE-96). An unauthenticated attacker with network access to the N-central management interface can execute arbitrary code on the server, potentially compromising every managed endpoint under the platform's control. Huntress confirmed active in-the-wild exploitation. N-able's hosted (NCOD) instances were automatically patched, on-premises deployments require manual upgrade to 2026.3.1.14. The N-central build version is exposed pre-authentication in the login page JavaScript object (ncentralVersion), enabling reliable version-based detection.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-86218.yaml"}
{"ID":"CVE-2026-86242","Info":{"Name":"Bifrost \u003c 1.6.3 - Unauthenticated Remote Plugin URL Fetch","Severity":"high","Description":"When dashboard authentication is disabled, Bifrost accepts an enabled custom plugin with an HTTP URL as its path. The gateway fetches the URL before attempting to load it. This template confirms the unauthenticated server-side request with an out-of-band callback; it does not assert code execution on statically linked builds.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"http/cves/2026/CVE-2026-86242.yaml"}
{"ID":"CVE-2026-86426","Info":{"Name":"LibreNMS \u003c= 26.7.0 - Unauthenticated API Access","Severity":"critical","Description":"LibreNMS \u003c= 26.8.0 contains an authentication bypass caused by MySQL type coercion in the REST API token validation, letting unauthenticated attackers access protected endpoints and execute remote code via alert templates.\n","Classification":{"CVSSScore":"9.2"}},"file_path":"http/cves/2026/CVE-2026-86426.yaml"}
{"ID":"CVE-2026-8679","Info":{"Name":"WordPress AudioIgniter \u003c= 2.0.2 - Unauthenticated IDOR","Severity":"high","Description":"The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. The handle_playlist_endpoint() function accepted a user-controlled playlist ID and returned track data without authentication.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-8679.yaml"}
{"ID":"CVE-2026-8713","Info":{"Name":"Avada (Fusion) Builder \u003c= 3.15.3 - Unauthenticated Arbitrary File Deletion","Severity":"critical","Description":"The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files function. An unauthenticated attacker can delete arbitrary files on the server by manipulating the file_path parameter in the fusion_form_maybe_delete_files AJAX action. Deleting critical files like wp-config.php can lead to complete site takeover via reinstallation. This template detects the vulnerable version via homepage asset URL versioning (primary) and readme.txt Stable tag (fallback).\n","Classification":{"CVSSScore":"9.1"}},"file_path":"http/cves/2026/CVE-2026-8713.yaml"}
{"ID":"CVE-2026-8732","Info":{"Name":"WP Maps Pro (wp-google-map-gold) \u003c= 6.1.0 - Unauthenticated Administrator Account Creation","Severity":"critical","Description":"The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ and protected only by a nonce check using the fc-call-nonce nonce, which is publicly embedded into every frontend page via wp_localize_script as the nonce field of the wpgmp_local JavaScript object, rendering the check ineffective as an access control mechanism. This makes it possible for unauthenticated attackers to invoke the wpgmp_temp_access_support handler with check_temp=false, which unconditionally creates a new WordPress user with the hardcoded role of administrator via wp_insert_user() and returns a magic login URL that, when visited, calls wp_set_auth_cookie() to fully authenticate the attacker as the newly created administrator, resulting in complete site takeover.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-8732.yaml"}
{"ID":"CVE-2026-87820","Info":{"Name":"CyberPanel 2.4.3-2.4.5 - AI Scanner Debug Disclosure","Severity":"medium","Description":"CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity to inventory multi-tenant installations and facilitate follow-on attacks.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-87820.yaml"}
{"ID":"CVE-2026-87902","Info":{"Name":"WordPress Core - PHP Template Path Traversal","Severity":"critical","Description":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.\n","Classification":{"CVSSScore":"9.2"}},"file_path":"http/cves/2026/CVE-2026-87902.yaml"}
{"ID":"CVE-2026-88062","Info":{"Name":"OmniRoute \u003c 3.8.49 - Unauthenticated RCE","Severity":"critical","Description":"OmniRoute \u003c= 3.8.49 contains a remote code execution caused by insufficient validation of interpreter arguments in the POST /api/acp/agents endpoint, letting remote attackers execute arbitrary code, exploit requires anonymous access when requireLogin is false or management session/API key when true.\n","Classification":{"CVSSScore":"9.5"}},"file_path":"http/cves/2026/CVE-2026-88062.yaml"}
{"ID":"CVE-2026-8839","Info":{"Name":"WordPress MapPress Maps \u003c= 2.96.6 - Unauthenticated IDOR","Severity":"medium","Description":"MapPress Maps for WordPress \u003c= 2.96.6 contains an authorization bypass caused by missing ownership verification in REST API routes, letting unauthenticated attackers read any map data and authenticated contributors modify any map, exploit requires crafted API requests\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-8839.yaml"}
{"ID":"CVE-2026-8857","Info":{"Name":"MediaWiki EasyTimeline - Code Injection RCE","Severity":"high","Description":"MediaWiki EasyTimeline (Timeline) extension versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9 contain a code injection vulnerability caused by insufficient neutralization of newlines in TextData text attributes in EasyTimeline.pl / Timeline.php. A crafted \u003ctimeline\u003e block can inject ploticus '#proc getdata' and 'command:' directives, which execute via /bin/sh because EasyTimeline invokes ploticus without the -noshell flag. Exploitation requires the ability to submit timeline markup for rendering — low-privileged edit access, or anonymous access on wikis that allow anonymous editing and API use. This template's parse-based check needs API read access; optional username/password inputs can be supplied for private wikis that deny anonymous read.\n","Classification":{"CVSSScore":"8.8"}},"file_path":"http/cves/2026/CVE-2026-8857.yaml"}
{"ID":"CVE-2026-88804","Info":{"Name":"SUSE Rancher - Stored XSS via Unauthenticated Settings Override","Severity":"high","Description":"SUSE Rancher supports HTTP method override via the `_method` query parameter in the Norman API framework. Public UI settings routes were intended to be read-only for unauthenticated users, but the method override allows an unauthenticated attacker to perform PUT requests, modifying settings such as `ui-pl` (the product-line branding value). This value is rendered as raw HTML on the Rancher login page (`/dashboard/auth/login`) without sanitization, enabling stored cross-site scripting. Any user who subsequently opens the login page executes the attacker-controlled script in the Rancher origin, potentially leading to administrator session hijacking, bootstrap password disclosure, or full administrative control of the Rancher installation and its downstream clusters.\n","Classification":{"CVSSScore":"9.6"}},"file_path":"http/cves/2026/CVE-2026-88804.yaml"}
{"ID":"CVE-2026-89013","Info":{"Name":"Dolibarr \u003c 24.0.0 - Authorization Bypass via hashp Parameter","Severity":"high","Description":"Dolibarr ERP/CRM versions 23.0.4 through 24.0.0 contain an authorization bypass vulnerability in document.php and viewimage.php. The public share-link feature forces NOLOGIN when hashp is present, but the value 'shared' skips token resolution while the override still fires for any non-empty hashp value. This bypass allows unauthenticated remote attackers to read arbitrary files from all Dolibarr managed directories including logs, SQL database backups, invoices, contracts, user vcards, and custom module sources.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-89013.yaml"}
{"ID":"CVE-2026-89026","Info":{"Name":"Issabel Framework - Hard-Coded PBX API JWT Key","Severity":"critical","Description":"Issabel Framework before commit b97dbaf uses a shared HS256 key for PBX API bearer tokens. This template uses the read-only AMI ExtensionState action to check whether the PBX API accepts a short-lived token signed with either the vulnerable upstream-source key or the key in the 5.0.0-2 RPM, after rejecting an unrelated key.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"http/cves/2026/CVE-2026-89026.yaml"}
{"ID":"CVE-2026-89063","Info":{"Name":"Bookly \u003c=28.1 - IDOR Unauthenticated Sensitive Data Access","Severity":"high","Description":"Bookly WordPress plugin \u003c= 28.1 contains an insecure direct object reference caused by missing validation on 'conversation_id' parameter, letting unauthenticated attackers read and inject messages into any AI booking conversation, exploit requires no authentication.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"http/cves/2026/CVE-2026-89063.yaml"}
{"ID":"CVE-2026-89079","Info":{"Name":"Theme My Login \u003c= 7.2.1 - Privilege Escalation","Severity":"critical","Description":"Theme My Login (TML) \u003c= 7.2.1 for WordPress is vulnerable to unauthenticated account takeover on multisite installations. The multisite-only filter tml_ms_filter_pre_insert_user_data(), hooked on wp_pre_insert_user_data, hashes and injects $_POST['user_pass1'] into the user record whenever the tml_user_passwords network option is enabled, WITHOUT checking the $update flag. During a lost password request (wp-login.php?action=lostpassword -\u003e retrieve_password() -\u003e wp_update_user()), this filter fires on the EXISTING target user, overwriting their password with an attacker-chosen value. An unauthenticated attacker can therefore take over any account, including a network administrator, by sending user_pass1 in the lost-password POST. Fixed in 7.2.2 (changeset 3696081 / commit 06b76231) by adding the $update guard and only applying the password during activation.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-89079.yaml"}
{"ID":"CVE-2026-9062","Info":{"Name":"WordPress Agile Store Locator \u003c 1.6.9 - Arbitrary File Read","Severity":"low","Description":"The Agile Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary .php files from the server.\n","Classification":{"CVSSScore":"3.4"}},"file_path":"http/cves/2026/CVE-2026-9062.yaml"}
{"ID":"CVE-2026-90774","Info":{"Name":"rustypaste \u003c 0.18.1 - Filename Header Path Traversal","Severity":"high","Description":"rustypaste before 0.18.1 contains a path traversal caused by improper validation of the custom filename HTTP header, letting attackers write files outside the upload directory.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-90774.yaml"}
{"ID":"CVE-2026-90817","Info":{"Name":"REDCap \u003e= 13.3.0 - Unauthenticated Remote Code Execution via Survey Passthru","Severity":"critical","Description":"REDCap versions 13.3.0 through 16.0.48 LTS, 17.3.9 LTS, and 17.4.3 Standard contain an unauthenticated remote code execution vulnerability. The application is vulnerable to an authentication bypass via a double-URL-decoded __passthru parameter (%2569ndex.php -\u003e index.php) on public survey endpoints, which routes requests to internal authenticated controllers. An unauthenticated attacker can abuse this routing flaw combined with PHP filter chains to inject and execute arbitrary code through the Laravel Blade template cache.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-90817.yaml"}
{"ID":"CVE-2026-9082","Info":{"Name":"Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query","Severity":"critical","Description":"Drupal core from 8.9.0 before 10.4.10, 10.5.0 before 10.5.10, 10.6.0 before 10.6.9, 11.0.0 before 11.1.10, 11.2.0 before 11.2.12, and 11.3.0 before 11.3.10 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-9082.yaml"}
{"ID":"CVE-2026-90898","Info":{"Name":"Bifrost \u003c 2.1.0 - Unauthenticated MCP Stdio Command Execution","Severity":"critical","Description":"When dashboard authentication is disabled, Bifrost accepts an unauthenticated stdio MCP client registration and starts its configured command before the MCP handshake completes. This template runs a benign outbound HTTP request from the target and requires an out-of-band callback to confirm command execution.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"http/cves/2026/CVE-2026-90898.yaml"}
{"ID":"CVE-2026-9103","Info":{"Name":"Langflow OSS - Superuser Token Issuance","Severity":"critical","Description":"Langflow OSS with default AUTO_LOGIN exposes `/api/v1/auto_login`, which returns a superuser access token to any unauthenticated request.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-9103.yaml"}
{"ID":"CVE-2026-91136","Info":{"Name":"Divi Plus \u003c= 2.4.0 - Unauthenticated Arbitrary File Read","Severity":"high","Description":"The Divi Plus WordPress plugin through 2.4.0 exposes the /wp-json/elicus/v1/dipl-modules/svg-animator REST route with a permission callback that returns true unconditionally, and passes the svg_image parameter to file_get_contents() without any path restriction, so an unauthenticated attacker can read any file readable by the web server user.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-91136.yaml"}
{"ID":"CVE-2026-9133","Info":{"Name":"Amazon rabbitmq-aws 0.1.0 through 0.2.0 - Arbitrary File Read","Severity":"high","Description":"Amazon rabbitmq-aws versions 0.1.0 through 0.2.0 contain active debug code in the ARN resolver. An authenticated RabbitMQ user with management API access can submit an arn:aws-debug:file ARN to the validation endpoint and read arbitrary files accessible to the RabbitMQ process.\n","Classification":{"CVSSScore":"7.7"}},"file_path":"http/cves/2026/CVE-2026-9133.yaml"}
{"ID":"CVE-2026-9198","Info":{"Name":"IBM Langflow - Remote Code Execution","Severity":"critical","Description":"IBM Langflow OSS 1.0.0 through 1.10.0 contains a remote code execution caused by chaining /api/v1/auto_login and /api/v1/validate/code endpoints, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-9198.yaml"}
{"ID":"CVE-2026-9282","Info":{"Name":"W3 Total Cache \u003c= 2.9.4 - Unauthenticated Arbitrary File Read","Severity":"high","Description":"W3 Total Cache WordPress plugin \u003c= 2.9.4 contains a directory traversal caused by improper handling in setupSources function, letting unauthenticated attackers read arbitrary files, exploit requires manual minify mode enabled with specific filename.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-9282.yaml"}
{"ID":"CVE-2026-9290","Info":{"Name":"WP User Manager – User Profile Builder \u0026 Membership - Local File Inclusion","Severity":"high","Description":"WP User Manager – User Profile Builder \u0026 Membership plugin for WordPress \u003c= 2.9.17 contains a local file inclusion caused by improper handling in the profile template scope function, letting unauthenticated attackers execute arbitrary PHP code, exploit requires ability to upload or control PHP files.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-9290.yaml"}
{"ID":"CVE-2026-93485","Info":{"Name":"WordPress Core \u003c 7.1.1 - Unauthenticated Stored XSS via Comment (Comment2Shell)","Severity":"high","Description":"WordPress core before 7.1.1 is vulnerable to unauthenticated stored XSS via crafted blockquote comments. wp_kses_post accepts a \u003cblockquote\u003e with a literal newline in the cite attribute, wpautop's non-quote-aware regex injects a \u003cp\u003e inside the cite value, and wptexturize leaves the attribute open so onfocus/autofocus land on \u003ccode\u003e as real HTML attributes, giving zero-click stored XSS. Only triggers when comments are open and auto-approved.\n","Classification":{"CVSSScore":"7.1"}},"file_path":"http/cves/2026/CVE-2026-93485.yaml"}
{"ID":"CVE-2026-93616","Info":{"Name":"Check Point Security Management - Unauthenticated Directory Traversal to RCE","Severity":"critical","Description":"Check Point Management Server contains a directory traversal and unrestricted file upload vulnerability allowing unauthenticated attackers to upload and execute arbitrary scripts remotely, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-93616.yaml"}
{"ID":"CVE-2026-93674","Info":{"Name":"Langflow OSS \u003c=1.12.2 - Unauthenticated RCE via Import Code Execution","Severity":"critical","Description":"Langflow OSS 1.0.0 through 1.12.2 is vulnerable to unauthenticated remote code execution via the POST /api/v1/validate/code endpoint, which calls importlib.import_module() on user-supplied import statements, executing module top-level code instead of merely validating syntax.\nCombined with the default LANGFLOW_AUTO_LOGIN=true configuration (which issues a superuser JWT from GET /api/v1/auto_login with no credentials) and the custom_component exec() sink (POST /api/v1/custom_component, which can plant arbitrary Python modules into site-packages), a remote unauthenticated attacker achieves arbitrary OS command execution.\nFixed in 1.12.3 by replacing importlib.import_module() with importlib.util.find_spec() (commit 461506ac2f).\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-93674.yaml"}
{"ID":"CVE-2026-94169","Info":{"Name":"The Grid \u003c= 2.8.1 - Unauthenticated Code Injection","Severity":"critical","Description":"Theme-one The Grid \u003c= 2.8.1 contains a command injection caused by improper control of code generation, letting attackers execute arbitrary commands remotely, exploit requires crafted input.\n","Classification":{"CVSSScore":"10"}},"file_path":"http/cves/2026/CVE-2026-94169.yaml"}
{"ID":"CVE-2026-9506","Info":{"Name":"Bagisto \u003c= 2.4.1 - Unauthenticated Arbitrary File Read","Severity":"high","Description":"Bagisto through 2.4.1 is vulnerable to unauthenticated path traversal in the ImageCache controller. The `original` image-cache route (/cache/original/{filename}) passes the user-supplied filename to getImagePath() without any '..' filtering or realpath containment, allowing a remote unauthenticated attacker to read files outside the intended public image directories (upload/images) - for example the application's composer.json, artisan and other source files.\n","Classification":{"CVSSScore":"8.7"}},"file_path":"http/cves/2026/CVE-2026-9506.yaml"}
{"ID":"CVE-2026-9586","Info":{"Name":"Sangoma Switchvox \u003c 8.4.0.2 - Unauthenticated SQL Injection","Severity":"critical","Description":"Sangoma Switchvox before version 8.4.0.2 contains an unauthenticated SQL injection vulnerability in the /pa endpoint (PhoneAppsHandler.pm). The PhoneIP field extracted from an XML POST body is concatenated directly into an unparameterized PostgreSQL query that runs as a database superuser. An attacker can break out of the single-quoted SQL string context and leverage PostgreSQL COPY TO PROGRAM to execute arbitrary operating system commands without authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-9586.yaml"}
{"ID":"CVE-2026-96652","Info":{"Name":"Plex Media Server \u003c 1.43.3.10861 - Unauthenticated SSRF via Companion Protocol (plex2shell)","Severity":"medium","Description":"Plex Media Server \u003c 1.43.3.10861 contains a server side request forgery caused by improper validation of the 'protocol' parameter in /player/timeline, letting attackers with any X-Plex-Token value force the server to POST to arbitrary destinations, exploit requires any X-Plex-Token value.\n","Classification":{"CVSSScore":"4.3"}},"file_path":"http/cves/2026/CVE-2026-96652.yaml"}
{"ID":"CVE-2026-96655","Info":{"Name":"Plex Media Server \u003c 1.43.3.10861 - SSRF via Transcoder","Severity":"medium","Description":"Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"http/cves/2026/CVE-2026-96655.yaml"}
{"ID":"CVE-2026-97229","Info":{"Name":"GitLab CE/EE \u003c 19.2.8 / 19.3.5 / 19.4.2 - Unauthenticated RCE via Onigmo Integer Overflow","Severity":"critical","Description":"GitLab CE/EE 19.2.0–19.2.7, 19.3.0–19.3.4, and 19.4.0–19.4.1 contain a remote code execution caused by insufficient regular expression validation in CI/CD configuration, letting unauthenticated users execute arbitrary code remotely, exploit requires crafted regex in CI/CD config\n","Classification":{"CVSSScore":"10.0"}},"file_path":"http/cves/2026/CVE-2026-97229.yaml"}
{"ID":"CVE-2026-97359","Info":{"Name":"Rejetto HTTP File Server 2.4.x - Template Injection","Severity":"critical","Description":"Rejetto HTTP File Server (HFS) 2.4.x inserts the multipart upload filename into the server-side template symbol map as %item-resource% without escaping. A filename containing the literal %item-resource% is substituted a second time by the sequential global replacement in xtpl(), allowing a :} sequence to terminate the quoting region so a following {.exec|...} macro is executed as an operating-system command. An unauthenticated attacker achieves remote code execution with a single request.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"http/cves/2026/CVE-2026-97359.yaml"}
{"ID":"CVE-2026-9833","Info":{"Name":"WordPress Tag Groups \u003c 2.2.0 - Reflected Cross-Site Scripting","Severity":"high","Description":"The Tag Groups WordPress plugin \u003c 2.2.0 contains a stored XSS caused by improper escaping of an AJAX parameter reflected in an HTML response, letting unauthenticated attackers execute arbitrary JavaScript in browsers of logged-in users with edit_pages capability, exploit requires victim interaction.\n","Classification":{"CVSSScore":"7.1"}},"file_path":"http/cves/2026/CVE-2026-9833.yaml"}
{"ID":"CVE-2026-9848","Info":{"Name":"WP Ticket \u003c= 6.0.4 - SQL Injection","Severity":"high","Description":"WP Ticket (wp-ticket) for WordPress through 6.0.4 allows unauthenticated SQL injection via front-end search due to unsanitized use of the \"s\" parameter in emd_author_search_results(). Exploitation requires at least one guest ticket. Fixed in 6.0.5.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"http/cves/2026/CVE-2026-9848.yaml"}
{"ID":"CVE-2001-1473","Info":{"Name":"Deprecated SSHv1 Protocol Detection","Severity":"high","Description":"SSHv1 is deprecated and has known cryptographic issues.","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2001/CVE-2001-1473.yaml"}
{"ID":"CVE-2004-0437","Info":{"Name":"Titan FTP Server 3.01 - DoS via LIST Command Disconnection","Severity":"medium","Description":"Titan FTP Server version 3.01 build 163 (and possibly other older versions) contains a vulnerability where disconnecting during a LIST -L command may crash the daemon. Remote attackers can cause denial of service by initiating a LIST -L command and then abruptly disconnecting, leading to server instability.\n","Classification":{"CVSSScore":"5"}},"file_path":"network/cves/2004/CVE-2004-0437.yaml"}
{"ID":"CVE-2004-0656","Info":{"Name":"Pure-FTPd ≤ 1.0.18 - DoS via Connection Limit Exhaustion","Severity":"medium","Description":"Pure-FTPd versions ≤ 1.0.18 are vulnerable to denial of service through connection limit exhaustion. The vulnerability occurs in the accept_client function when the maximum number of connections is exceeded, potentially causing the server to become unresponsive or crash.\n","Classification":{"CVSSScore":"5"}},"file_path":"network/cves/2004/CVE-2004-0656.yaml"}
@@ -4258,10 +4527,13 @@
{"ID":"CVE-2024-23108","Info":{"Name":"Fortinet FortiSIEM - OS Command Injection","Severity":"critical","Description":"FortiSIEM versions 6.4.0 through 7.1.1 contain an OS command injection vulnerability in the Phoenix Monitor service. The vulnerability exists in the XML parsing of TEST_STORAGE elements where the mount_point field is not properly sanitized before being passed to shell commands, allowing unauthenticated remote code execution.\n","Classification":{"CVSSScore":"10"}},"file_path":"network/cves/2024/CVE-2024-23108.yaml"}
{"ID":"CVE-2024-48208","Info":{"Name":"Pure-FTPd \u003c 1.0.52 - Buffer Overflow","Severity":"high","Description":"Pure-FTPd versions prior to 1.0.52 contain a buffer overflow vulnerability due to an out-of-bounds read in the domlsd() function within the ls.c file. This vulnerability could allow attackers to execute arbitrary code on affected systems.\n","Classification":{"CVSSScore":"8.6"}},"file_path":"network/cves/2024/CVE-2024-48208.yaml"}
{"ID":"CVE-2024-48651","Info":{"Name":"ProFTPD ≤ 1.3.8b - Privilege Escalation via mod_sql","Severity":"high","Description":"ProFTPD versions through 1.3.8b (before commit cec01cc) contain a vulnerability in the mod_sql module due to improper handling of supplemental groups. This flaw allows authenticated users without explicitly assigned supplemental groups to inherit root group privileges (GID 0), potentially granting unauthorized access to sensitive system resources.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2024/CVE-2024-48651.yaml"}
{"ID":"CVE-2024-54772","Info":{"Name":"MikroTik WinBox \u003c= 6.49.17 - Username Enumeration","Severity":"medium","Description":"MikroTik RouterOS v6.43.13 through v6.49.13 and v6.43 through v7.17.2 contain an account enumeration issue caused by response size discrepancy in Winbox service, letting attackers identify valid usernames, exploit requires network access to Winbox service.\n","Classification":{"CVSSScore":"5.3"}},"file_path":"network/cves/2024/CVE-2024-54772.yaml"}
{"ID":"CVE-2025-14847","Info":{"Name":"MongoDB Server - Information Disclosure (MongoBleed)","Severity":"high","Description":"MongoDB Server contained a flaw in the zlib decompression logic where mismatched length fields in compressed protocol headers allowed a read of uninitialized heap memory by an unauthenticated client.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"network/cves/2025/CVE-2025-14847.yaml"}
{"ID":"CVE-2025-25256","Info":{"Name":"Fortinet FortiSIEM - OS Command Injection","Severity":"critical","Description":"Fortinet FortiSIEM 6.7.9 \u003c version \u003c= 7.3.1 contains an OS command injection caused by improper neutralization of special elements in CLI requests, letting unauthenticated attackers execute unauthorized commands remotely.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2025/CVE-2025-25256.yaml"}
{"ID":"CVE-2025-8286","Info":{"Name":"Güralp Systems FMUS Series - Unauthenticated Access","Severity":"critical","Description":"Güralp Systems FMUS Series Seismic Monitoring Devices expose an unauthenticated Telnet-based command line interface that allows attackers to modify hardware configurations, manipulate data, or factory reset the device.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2025/CVE-2025-8286.yaml"}
{"ID":"CVE-2026-23829","Info":{"Name":"Mailpit \u003c 1.28.2 - SMTP CRLF Injection","Severity":"medium","Description":"Mailpit \u003c 1.28 contains a header injection caused by insufficient regex validation of `RCPT TO` and `MAIL FROM` addresses in the SMTP server, letting attackers inject arbitrary SMTP headers, exploit requires crafted email addresses\n","Classification":{"CVSSScore":"5.3"}},"file_path":"network/cves/2026/CVE-2026-23829.yaml"}
{"ID":"CVE-2026-42167","Info":{"Name":"ProFTPD mod_sql - Preauth User Backdoor","Severity":"high","Description":"ProFTPD mod_sql before 1.3.10rc1 contains a remote code execution caused by unsafe username handling with SQL backend commands in USER request logging expansions, letting remote attackers execute arbitrary code, exploit requires SQL backend allowing commands.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"network/cves/2026/CVE-2026-42167.yaml"}
{"ID":"CVE-2026-73570","Info":{"Name":"Zimbra Collaboration Suite \u003c 10.1.20 - OS Command Injection","Severity":"high","Description":"Zimbra Collaboration Suite (ZCS) before version 10.1.20 is vulnerable to OS command injection in the SNMP notification processing due to improper input sanitization. According to the NVD, when SNMP notifications are enabled and the zimbra-snmp package is installed, an unauthenticated attacker can inject arbitrary commands using crafted SMTP requests that result in malicious log entries. The swatchdog service monitors the log, and upon matching a pattern, passes the log content to zmsnmptrapd, which unsafely uses the Perl backtick operator to execute commands. This can ultimately allow remote attackers to execute arbitrary operating system commands as the zimbra user. Active exploitation of this vulnerability has been observed in the wild, as confirmed by CERT Polska and CISA.\n","Classification":{"CVSSScore":"8.9"}},"file_path":"network/cves/2026/CVE-2026-73570.yaml"}
{"ID":"CVE-2010-20103","Info":{"Name":"ProFTPd-1.3.3c - Backdoor Command Execution","Severity":"critical","Description":"ProFTPD 1.3.3c contains a command injection backdoor caused by a hidden FTP command trigger in the source tarball, letting remote unauthenticated attackers execute arbitrary shell commands with root privileges.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2010/CVE-2010-20103.yaml"}
{"ID":"CVE-2012-2122","Info":{"Name":"MySQL - Authentication Bypass","Severity":"medium","Description":"sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.\n","Classification":{"CVSSScore":"5.1"}},"file_path":"javascript/cves/2012/CVE-2012-2122.yaml"}
{"ID":"CVE-2016-8706","Info":{"Name":"Memcached Server SASL Authentication - Remote Code Execution","Severity":"high","Description":"An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.\n","Classification":{"CVSSScore":"8.1"}},"file_path":"javascript/cves/2016/CVE-2016-8706.yaml"}
@@ -4286,7 +4558,6 @@
{"ID":"CVE-2024-45519","Info":{"Name":"Zimbra Collaboration Suite \u003c 9.0.0 - Remote Code Execution","Severity":"critical","Description":"SMTP-based vulnerability in the PostJournal service of Zimbra Collaboration Suite that allows unauthenticated attackers to inject arbitrary commands. This vulnerability arises due to improper sanitization of SMTP input, enabling attackers to craft malicious SMTP messages that execute commands under the Zimbra user context. Successful exploitation can lead to unauthorized access, privilege escalation, and potential compromise of the affected system's integrity and confidentiality.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2024/CVE-2024-45519.yaml"}
{"ID":"CVE-2024-47176","Info":{"Name":"CUPS - Remote Code Execution","Severity":"high","Description":"CUPS is a standards-based, open-source printing system, and cups-browsed contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. cups-browsed binds to INADDR_ANY-631, causing it to trust any packet from any source, and can cause the Get-Printer-Attributes IPP request to an attacker controlled URL.\nDue to the service binding to *-631 ( INADDR_ANY ), multiple bugs in cups-browsed can be exploited in sequence to introduce a malicious printer to the system. This chain of exploits ultimately enables an attacker to execute arbitrary commands remotely on the target machine without authentication when a print job is started. This poses a significant security risk over the network. Notably, this vulnerability is particularly concerning as it can be exploited from the public internet, potentially exposing a vast number of systems to remote attacks if their CUPS services are enabled.\n","Classification":{"CVSSScore":"8.3"}},"file_path":"javascript/cves/2024/CVE-2024-47176.yaml"}
{"ID":"CVE-2025-12101","Info":{"Name":"Citrix NetScaler ADC \u0026 Gateway - Reflected XSS / Open Redirect","Severity":"medium","Description":"Cross-Site Scripting (XSS) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2025/CVE-2025-12101.yaml"}
{"ID":"CVE-2025-14847","Info":{"Name":"MongoDB Server - Information Disclosure (MongoBleed)","Severity":"high","Description":"MongoDB Server contained a flaw in the zlib decompression logic where\nmismatched length fields in compressed protocol headers allowed a read\nof uninitialized heap memory by an unauthenticated client.\n","Classification":{"CVSSScore":"7.5"}},"file_path":"javascript/cves/2025/CVE-2025-14847.yaml"}
{"ID":"CVE-2025-46817","Info":{"Name":"Redis \u003c 8.2.1 lua script - Integer Overflow","Severity":"critical","Description":"Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2025/CVE-2025-46817.yaml"}
{"ID":"CVE-2025-46818","Info":{"Name":"Redis Lua Sandbox \u003c 8.2.2 - Cross-User Escape","Severity":"high","Description":"Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2025/CVE-2025-46818.yaml"}
{"ID":"CVE-2025-46819","Info":{"Name":"Redis \u003c 8.2.1 Lua Long-String Delimiter - Out-of-Bounds Read","Severity":"high","Description":"Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2025/CVE-2025-46819.yaml"}
@@ -4295,6 +4566,7 @@
{"ID":"CVE-2026-15409","Info":{"Name":"SonicWall SMA1000 - Server-Side Request Forgery","Severity":"critical","Description":"SMA1000 Appliance Work Place interface contains a server side request forgery caused by improper request validation, letting remote unauthenticated attackers make requests to unintended locations, exploit requires no special privileges.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"javascript/cves/2026/CVE-2026-15409.yaml"}
{"ID":"CVE-2026-16232","Info":{"Name":"Check Point Security Management Server - SmartConsole Authentication Bypass","Severity":"critical","Description":"An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"javascript/cves/2026/CVE-2026-16232.yaml"}
{"ID":"CVE-2026-1731","Info":{"Name":"BeyondTrust Remote Support - Unauthenticated WebSocket RCE","Severity":"critical","Description":"BeyondTrust Remote Support is vulnerable to unauthenticated remote code execution via the WebSocket endpoint /nw. An attacker can extract the company identifier from the /get_mech_list endpoint and use it to connect to the WebSocket service, then inject OS commands through the binary WebSocket payload that are executed on the server.\n","Classification":{"CVSSScore":"N/A"}},"file_path":"javascript/cves/2026/CVE-2026-1731.yaml"}
{"ID":"CVE-2026-27886","Info":{"Name":"Strapi \u003c=5.36.x - Admin Credential Enumeration","Severity":"critical","Description":"Strapi versions starting in 4.0.0 and prior to 5.37.0 did not sufficiently sanitize query parameters when filtering content via relational fields. An attacker could use the `where` query parameter on any publicly-accessible content-type with an `updatedBy` field to perform a boolean-oracle attack against private fields on the joined admin_users table, including the resetPasswordToken field, enabling full administrative account takeover without authentication.\n","Classification":{"CVSSScore":"9.2"}},"file_path":"javascript/cves/2026/CVE-2026-27886.yaml"}
{"ID":"CVE-2026-33453","Info":{"Name":"Apache Camel camel-coap - Remote Code Execution","Severity":"critical","Description":"Apache Camel camel-coap component 4.14.0-4.14.5, 4.18.0 before 4.18.1, and 4.19.0 contains a remote code execution caused by improper header filtering of CoAP URI query parameters, letting unauthenticated attackers inject headers and execute arbitrary OS commands via header-sensitive producers, exploit requires sending a single CoAP UDP packet.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"javascript/cves/2026/CVE-2026-33453.yaml"}
{"ID":"CVE-2026-39363","Info":{"Name":"Vite Dev Server - Arbitrary File Read","Severity":"high","Description":"Vite dev server exposes the fetchModule method via its WebSocket HMR (Hot Module Replacement) endpoint using the vite-hmr sub-protocol. By connecting to the WebSocket endpoint and sending a crafted vite:invoke custom event that calls fetchModule with a file:// URL (e.g., file:///etc/passwd?raw), an attacker can bypass server.fs.deny restrictions and read arbitrary files from the server filesystem. The vulnerability exists because fetchModule does not enforce the same filesystem access controls as other Vite server endpoints.\n","Classification":{"CVSSScore":"8.2"}},"file_path":"javascript/cves/2026/CVE-2026-39363.yaml"}
{"ID":"CVE-2026-39987","Info":{"Name":"Marimo \u003c= 0.20.4 - Pre-Auth Terminal WebSocket RCE","Severity":"critical","Description":"Marimo versions \u003c= 0.20.4 contain an unauthenticated remote code execution vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to connect via WebSocket, obtain a full PTY shell, and execute arbitrary OS commands on the underlying server.\n","Classification":{"CVSSScore":"9.3"}},"file_path":"javascript/cves/2026/CVE-2026-39987.yaml"}
@@ -4302,3 +4574,5 @@
{"ID":"CVE-2026-4480","Info":{"Name":"Samba Printing Subsystem - Remote Code Execution","Severity":"critical","Description":"A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the \"print command\" setting via the \"%J\" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"javascript/cves/2026/CVE-2026-4480.yaml"}
{"ID":"CVE-2026-48908","Info":{"Name":"Joomla SP Page Builder \u003c= 6.6.1 - Unauthenticated Arbitrary File Upload RCE","Severity":"critical","Description":"SP Page Builder for Joomla contains an unrestricted file upload vulnerability allowing unauthenticated users to upload and execute arbitrary PHP code, exploit requires no authentication.\n","Classification":{"CVSSScore":"9.8"}},"file_path":"javascript/cves/2026/CVE-2026-48908.yaml"}
{"ID":"CVE-2026-48909","Info":{"Name":"Joomla SP LMS \u003c= 4.1.3 - Remote Code Execution","Severity":"critical","Description":"SP LMS (com_splms) \u003c 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server.\n","Classification":{"CVSSScore":"9.5"}},"file_path":"javascript/cves/2026/CVE-2026-48909.yaml"}
{"ID":"CVE-2026-55040","Info":{"Name":"Microsoft SharePoint Server - JWT Authentication Bypass","Severity":"critical","Description":"Microsoft SharePoint Server is vulnerable to an authentication bypass (CVE-2026-55040) in its JWT token validation pipeline (SPJsonWebSecurityTokenHandlerV2). The chain disables signature requirements (RequireSignedTokens=false, accepting alg:none tokens), resolves the actor token x5t thumbprint against the server's own STS signing certificate (freely retrievable from /_layouts/15/metadata/json/1) without verifying the signature, accepts unregistered certificate issuers, and only checks the actor token signature is non-empty. An unauthenticated remote attacker can forge a JWT and authenticate as any SharePoint user, including a site administrator. This template forges such a token and confirms the bypass by obtaining a SharePoint form digest.\n","Classification":{"CVSSScore":"9.1"}},"file_path":"javascript/cves/2026/CVE-2026-55040.yaml"}
{"ID":"CVE-2026-83548","Info":{"Name":"SonicWall SMA1000 WorkPlace - Unauthenticated SSRF to CouchDB","Severity":"critical","Description":"A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path.\n","Classification":{"CVSSScore":"10.0"}},"file_path":"javascript/cves/2026/CVE-2026-83548.yaml"}
The default installation of Krpano Panorama Viewer version 1.20.8 and before is prone to reflected cross-site scripting via the xml parameter in krpano.html. When passQueryParameters allows the xml parameter, a remote XML file supplied in the URL is loaded and its embedded Javascript action is executed in the origin of the viewer.
impact:|
An attacker can execute arbitrary Javascript in the victim's browser in the context of the vulnerable site by sending a crafted link, which can lead to session theft or actions performed on behalf of the victim.
remediation:|
Update to the latest Krpano version and set passQueryParameters to a fixed list of parameters that does not include xml, instead of true.
Loaded 100 of 5283 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
ghost