Daily summary
Vulnerabilities of 3 November 2026: 2758 new, 221 critical, 1 newly exploited
2758 vulnerabilities added on 3 November 2026, 221 critical and 889 high: HPE ArubaOS (71), Privilege escalation in WordPress plugins, Remote code execution in WordPress plugins and more. 1 vulnerability newly listed as exploited by CISA.
- 221 critical
- 889 high
- 879 medium
- 137 low
- 632 unrated
- 1 newly exploited
Newly listed as exploited
Added to CISA's Known Exploited Vulnerabilities catalog: attackers use it.
HPE ArubaOS
71 vulnerabilities · Servers and applications
- 10.0Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10
- 10.0Authentication Bypass Leading to Remote Code Execution in AOS-8
- 10.0Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8
- 10.0Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8
- 10.0Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10
Show 66 more
- 10.0Unauthenticated Command Injection Vulnerabilities in AOS-8
- 10.0Authentication Bypass Leading to Remote Code Execution in AOS-10
- 9.8Unauthenticated Command Injection Vulnerability in the PAPI Protocol of AOS-10
- 9.8Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8
- 9.8Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8
- 9.8Unauthenticated SQL Injection Vulnerability in the PAPI Protocol of AOS-8
- 9.8Unauthenticated Command Injection Vulnerability in AOS-8 PAPI Protocol
- 9.8Unauthenticated Buffer Overflow Vulnerability leads to Authentication Bypass in AOS-8
- 9.8Authentication Bypass in the SSH Daemon of AOS-8 leads to Complete System Compromise
- 9.8Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in AOS-10
- 9.8Unauthenticated Sensitive Information Disclosure leads to Remote Code Execution in AOS-10
- 9.8Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management Interface
- 9.6Unauthenticated Sensitive Information Disclosure in the Command Line Interface of AOS-10
- 9.6Authentication Bypass leads to Unauthorized Access in AOS-8
- 9.6Authentication Bypass Leading to Remote Code Execution in AOS-10
- 9.6Authentication Bypass Vulnerabilities lead to Complete System Compromise in AOS-8
- 9.6Authentication Bypass Leading to Remote Code Execution in AOS-8
- 9.6Unauthenticated Adjacent Path Traversal Vulnerability leads to Filesystem Compromise in AOS-8
- 9.6Unauthenticated Adjacent Memory Corruption Vulnerability leads to Remote Code Execution in AOS-10
- 9.6Unauthenticated Adjacent Command Injection Vulnerability in AOS-10
- 9.6Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution
- 9.6Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution
- 9.4Unauthenticated Buffer Overflow Vulnerability allows Remote Code Execution in AOS-10 and AOS-8
- 9.3Unauthenticated Adjacent Sensitive Information Disclosure in AOS-10 Wi-Fi Frame Processing
- 9.3Authentication Bypass in the PAPI Protocol of AOS-8 Allows Unauthorized Administrative Access
- 9.3Authentication Bypass in the API allows Administrative Access of AOS-10
- 9.3Unauthenticated Adjacent Authentication Bypasses in the PAPI Protocol of AOS-10 Leads to Unauthorized Administrative Access
- 8.8Unauthenticated Adjacent Memory Corruption Vulnerabilities lead to Remote Code Execution in AOS-10
- 8.8Unauthenticated Adjacent Command Injection Vulnerability in the AOS-8 Command Line Interface Accessed by the PAPI Protocol
- 8.8Unauthenticated Adjacent Remote Code Execution Vulnerability in AOS-10
- 8.7Authenticated Server-Side Request Forgery leads to Remote Code Execution in AOS-8
- 8.5Authentication Bypass Leading to Remote Code Execution in AOS-8
- 8.3Unauthenticated Adjacent Buffer Overflow Vulnerability in the PAPI Protocol leads to Sensitive Information Disclosure in AOS-10
- 8.3Unauthenticated Adjacent Command Injection Vulnerability in the PAPI Protocol of AOS-10
- 8.2Unauthenticated Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8
- 8.2Unauthenticated File Write Vulnerability leads to Denial-of-Service in AOS-8
- 8.2Authentication Bypass leads to Sensitive Information Disclosure in AOS-8
- 8.1Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-8
- 8.1Unauthenticated Command Injection Vulnerabilities in AOS-8 Accessed by the PAPI Protocol
- 8.1Multiple Unauthenticated Buffer Overflow vulnerabilities in AOS-8 Web Interface result in Remote Code Execution
- 8.1Unauthenticated Buffer Overflow allows Remote Code Execution in web interface
- 8.1Authentication Bypass in Web Interface of AOS-8 allows Remote Command Execution (RCE)
- 7.8Authenticated Local Memory Corruption Vulnerability leads to Arbitrary Code Execution in AOS-8
- 7.5Unauthenticated Memory Corruption Vulnerability leads to Denial-of-Service in AOS-8
- 7.5Unauthenticated Remote Denial-of-Service (DoS) Vulnerabilities in AOS-10
- 7.5Unauthenticated Denial-of-Service (DoS) Vulnerability in the PAPI Protocol of AOS-8
- 7.5Unauthenticated Memory Corruption Vulnerabilities lead to Denial-of-Service in AOS-10
- 7.2Authenticated Command Injection Vulnerabilities in AOS-10
- 7.2Authenticated File Write leads to Command Injection Vulnerabilities in AOS-10
- 7.2Authenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-8
- 7.2Authenticated Command Injection Vulnerabilities in AOS-8
- 7.2Authenticated Command Injection Vulnerabilities in AOS-8
- 7.2Authenticated Remote Code Execution allows Unauthorized System Control in Wireless Network Management Interface
- 7.2Improper Sanitization leads to Command Injection in AOS-8 Web Interface
- 7.1Unauthenticated Adjacent Sensitive Information Disclosure and Denial-of-Service in AOS-8 via the PAPI Protocol
- 7.1Authentication Bypass Leading to Remote Code Execution in AOS-10 Web-Based Management Interface
- 7.1Unauthenticated Adjacent Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-10 or AOS-8
- 7.0Unauthenticated Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8 Command Line Interface
- 6.8Unauthenticated Local Command Injection Vulnerability in AOS-10 Command Line Interface
- 6.8Authenticated Adjacent Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10
- 6.5Authentication Bypass in the PAPI Protocol of AOS-10 allows Unauthorized Configuration Changes
- 5.5Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in AOS Web-Based Management Interface
- 5.3Authentication Bypass Vulnerability in the PAPI Protocol of AOS-8
- 4.9Authenticated Arbitrary File Deletion Vulnerability leads to Denial-of-Service in AOS-10
- 4.4Authenticated Local Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8
- 3.3Authenticated Local Memory Corruption Vulnerability in AOS-8 Web-Based Management Interface
Privilege escalation in WordPress plugins
27 vulnerabilities
- 10.0Doctreat Core
- 9.8Theme My LoginUnauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter
- 9.8MailOptinUnauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter
- 9.8Tonda Membership
- 9.8AIWU
Show 22 more
- 9.8miniorange otp verification
- 9.8Meta Box AIO
- 9.8Taskbot
- 9.1Blocksy CompanionUnauthenticated Privilege Escalation to 'role' Parameter
- 8.8FooSalesAuthenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint
- 8.8Appointment BookingAuthenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter
- 8.8Salon booking system
- 8.8WP User Profiles
- 8.8Tourfic Pro
- 8.1User Profile BuilderUnauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]
- 8.1SMS Alert Order Notifications
- 7.5Nexter ExtensionAuthenticated (Subscriber+) Privilege Escalation to 'reset-view' Parameter
- 7.5InstaWP ConnectAuthenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability…
- 7.2Import and export users and customers
- 7.2PublishPress Capabilities
- 7.2Challan
- 6.8Online Scheduling and Appointment Booking SystemInsecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body
- 6.8Redux Framework– Authenticated (Subscriber+) Privilege Escalation via Users Extension
- 6.5WP User Manager
- 5.6Ultimate Member
- 5.4Academy LMSAuthenticated (Custom+) Privilege Escalation to add_child REST endpoint
- 4.8WP CompressUnauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint
Remote code execution in WordPress plugins
17 vulnerabilities
- 10.0The Grid
- 10.0SiteVault – Backup, Restore, Migration & Cloning
- 9.9WooCommerce Designer Pro
- 9.8My CalendarUnauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute
- 9.8Printcart IntegrationUnauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url
Show 12 more
- 9.83D Product configurator for WooCommerceUnauthenticated Remote Code Execution via 'xpv_image' Parameter
- 8.8WP Photo Album PlusAuthenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action
- 8.8Content Visibility for Divi Builder
- 8.1Everest Backup
- 8.0Tabs
- 7.2Fastcache by Host.itAuthenticated (Administrator+) Code Injection via .htaccess Directive Injection via 'cache_cookie_exclude' Setting
- 6.5Broken Link CheckerUnauthenticated Arbitrary Shortcode Execution via parser_callback
- 6.5Ocean ExtraUnauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template
- 5.4WP User AvatarAuthenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab
- 5.4Slim SEOAuthenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biographical Info' User Meta
- 5.4Kirki – Freeform Page Builder, Website Builder & CustomizerAuthenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'
- 5.3Name Directory
Apache Traffic Server
15 vulnerabilities · Servers and applications
- 10.0Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials
- 10.0Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement
- 10.0Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin
- 10.0Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration
- 9.3Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling
Show 10 more
- 9.3Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out
- 9.0Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication
- 8.9Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling
- 8.7Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request
- 8.6Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion
- 8.6Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion
- 8.2Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs
- 7.5Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service
- 5.9Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response
- 5.3Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout
Arbitrary file upload in WordPress plugins
15 vulnerabilities
Show 10 more
- 9.9Taskbot
- 9.9WP Duplicate
- 9.8ELEX WordPress HelpDesk & Customer Ticketing SystemUnauthenticated Arbitrary File Upload via IMAP Email Attachment
- 9.8Extensions For Cf7Unauthenticated Arbitrary File Upload via Signature Field File Upload
- 9.0Tailored Tools
- 8.8DoubleScale | All-in-One CRMAuthenticated (Subscriber+) Arbitrary File Upload via Portal 'ticketless' Attachment Endpoint
- 8.8YaySMTPAuthenticated (Subscriber+) Arbitrary File Upload via Attachment Filename Extension
- 8.8FV Player 8Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter
- 7.2Ultra Addons for Contact Form 7Unauthenticated Stored Cross-Site Scripting via File Upload
- 5.3CV Builder – Professional Resume Builder SaaSMissing Authorization to Unauthenticated PNG File Upload
WS_FTP Server
15 vulnerabilities · Servers and applications · most fixed in 2024.0.7, 2025.0.4
- 10.0Improper Authentication in Progress WS_FTP Server
- 9.9OS Command Injection in Progress WS_FTP Server
- 9.1Virtual Folder Path Confinement Bypass in Progress WS_FTP Server
- 9.1Host Administrator Path Containment Bypass in Progress WS_FTP Server
- 9.1Privilege Escalation via Missing Authorization in WS_FTP Manager
Show 10 more
- 9.0Command Injection via FTP Notification Variables in Progress WS_FTP Server
- 8.1Improper Access Control of Web Admin Console in Progress WS_FTP Server
- 7.7Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server
- 7.5Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server
- 6.8SSH Multi-Factor Authentication Bypass in Progress WS_FTP Server
- 6.6Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server
- 6.6Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server
- 5.3Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server
- 5.3Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server
- 4.3Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server
Magento / Adobe Commerce
11 vulnerabilities · Servers and applications
- 10.0Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
- 9.8Adobe Commerce | Incorrect Authorization (CWE-863)
- 9.3Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- 9.3Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- 9.1Adobe Commerce | Improper Input Validation (CWE-20)
Show 6 more
- 8.7Adobe Commerce | Improper Input Validation (CWE-20)
- 8.7Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- 8.3Adobe Commerce | Incorrect Authorization (CWE-863)
- 8.1Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
- 7.2Adobe Commerce | Incorrect Authorization (CWE-863)
- 4.3Adobe Commerce | Improper Input Validation (CWE-20)
Arbitrary file upload in WordPress themes
1 vulnerability
- 10.0Doctreat
Frappe Framework
23 vulnerabilities · Servers and applications
- 9.9Remote code execution via path traversal
- 9.4Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload
- 8.7Possibility of Server Side Template Injection
- 8.7Frappe before 15.41.0 Privilege Escalation via Document Action
- 8.2Frappe before 13.32.0 Weak Authentication via Print View Key
Show 18 more
- 7.1Frappe before 16.33.0 Blind SQL Injection via get_events
- 7.1Frappe before 13.46.3 Improper Access Control for Email Templates
- 6.9Frappe before 16.31.0 Improper Access Control in Document Follow Notifications
- 6.9Frappe 14.x before 14.45.0 Information Disclosure via Error Log Tracebacks
- 6.9Frappe before 14.59.0 Safe Execution Flag Bypass in Server Scripts
- 6.3Frappe before 15.86.0 LDAP Injection via Unsanitized Endpoint Parameters
- 5.9Frappe before 13.46.1 XSS via html2text Weak Sanitization
- 5.3Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication
- 5.3Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification
- 5.3Frappe before 16.33.0 Broken Authorization via send_sms Endpoint
- 5.3Frappe before 15.4.0 XSS via Printview Parameters
- 5.3Frappe before 13.22.0 Improper Authorization via Document Rename
- 5.1Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters
- 5.1Frappe before 15.91.1 Stored XSS via Leaderboard User Names
- 5.1Frappe before 14.31.0 HTML Injection via Weak Escaping
- 4.8Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkit
- 4.3Broken Access Control in File list/report queries
- MediumBlind SQL Injection in frappe.desk.doctype.event.event.get_events
Remote code execution in servers and applications
10 vulnerabilities
- 9.9Adobe Experience ManagerAdobe Experience Manager | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
- 9.5NetScaler ADC and GatewayMemory overflow vulnerability leading to Remote Code Execution or Denial of Service
- 9.4Wing FTP ServerPath Traversal in Wing WFTP Server leading to Remote Code Execution
- 9.4aaPanelaaPanel File Manager common.py ExecShell os command injection
- 9.4Movable TypeA code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script…
Show 5 more
- 8.6AdminerAdminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass
- 8.6SmarterMailSmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount
- 8.1Microsoft Exchange Server
- 7.2OPNsenseAuthenticated Root Command Injection via Firmware Mirror Configuration in OPNsense
- 6.9OllamaPath Traversal leading to Remote Code Execution in Ollama
Mautic
9 vulnerabilities · Servers and applications · most fixed in 5.2.12, 6.0.10, 7.2.2
Argo CD
7 vulnerabilities · Servers and applications · most fixed in 3.3.15, 3.4.10, 3.5.4
- 9.9AppProject restrictions bypassed by PreDelete/PostDelete resource hooks
- 9.9A Jsonnet import can read files from the repo-server
- 9.9A Kustomize Helm config home can run commands in the repo-server
- 9.9A Kustomize remote ref can run commands in the repo-server
- 8.8Command injection via a repository proxy URL on SSH Git repositories
Splunk Enterprise
4 vulnerabilities · Servers and applications · most fixed in 10.0.11, 10.2.8, 10.4.4
Linux kernel
746 vulnerabilities · Servers and applications
- 9.8net/mlx5e: Prevent stale XSK buffer release on refill retry
- 9.8net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
- 9.8btrfs: fix xattr replace when multiple xattrs are packed in the same item
- 9.8sctp: discard the rest of the packet on a stale-cookie error
- 9.8RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
Show 741 more
- 9.8RDMA/siw: Bound fragmented header copies by the remaining length
- 9.3RISC-V: KVM: Synchronize hrtimer callback during teardown
- 9.3ipv4: validate checksum_start before completing checksum
- 8.8namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
- 8.8namei: don't reveal overmounted entries in refwalk
- 8.8ksmbd: remove stale channels from all sessions on teardown
- 8.8Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID
- 8.8tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
- 8.8wifi: cfg80211: don't filter by BSS type when removing stale entries
- 8.8KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
- 8.8powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
- 8.4io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
- 8.4namespace: never expire a locked mount
- 8.2KVM: arm64: Transfer the hyp stack pages out of the host stage-2
- 8.1tcp: Fix potential UAF in reqsk_timer_handler().
- 8.1tipc: protect node reset trace dump with node lock
- 8.1cipso: adjust cached option offsets when removing CIPSO
- 8.1ipv6: do not let ipv6_find_hdr() return an offset past the packet end
- 8.1HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
- 8.1smb: client: fix missing iov bounds check in parse_posix_sids()
- 8.1IB/isert: wait for deferred control PDU completions before releasing the connection
- 8.1cifs: Fix server use-after-free in cifs_chan_skip_or_disable()
- 8.1net: lan743x: fix RX checksum use-after-free
- 7.8sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs
- 7.8io_uring/net: don't retry recv on uncommitted buffers
- 7.8fsverity: RCU-delay the freeing of struct fsverity_info
- 7.8gpio: mpsse: fix race when arming the IRQ poll worker
- 7.8riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
- 7.8riscv: futex: untag the user pointer before the atomic access
- 7.8Bluetooth: hci_sync: Fix command skb lifetime during scan setup
- 7.8Bluetooth: ISO: Reject concurrent BIS listener setup
- 7.8drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin
- 7.8namespace: reset the old parent's ->overmount in mnt_change_mountpoint()
- 7.8namespace: queue a mount only once for mount notifications
- 7.8namespace: don't let a pseudo dentry become the root of a mount
- 7.8namespace: keep the lock on a mount that a propagated copy is moved beneath
- 7.8xfs: stop exchanging reflink flags when exchanging mappings
- 7.8xfs: fix exchange-range-to-eof file size exchange
- 7.8HID: steam: Rearrange teardown sequence
- 7.8netfilter: ipset: mark the rcu locked areas properly
- 7.8wifi: iwlwifi: mvm: fix sched scan IE sizing
- 7.8bpf: Infer zext_dst based on static register liveness analysis
- 7.8rds: ib: Clear the sg list when mapping an MR fails
- 7.8drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping
- 7.8drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM
- 7.8drm/nouveau: fix double-free in nvif_vmm_dtor
- 7.8drm/xe/vm: nuke PTs only after unlinking contested VMAs
- 7.8net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
- 7.8net: bridge: mdb: restart port group walk after deletion
- 7.8net/sched: act_ct: fix helper UAF due to extensions realloc
- 7.8net/sched: act_ct: avoid modifying shared unconfirmed ct entry
- 7.8accel/amdxdna: Disable device buffer exporting
- 7.8sched/cache: Decouple sched_cache_group from mm to fix UAF
- 7.8bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
- 7.8veth: manage XDP program pointers during channel resize
- 7.8bpf: Reject dev-bound-only programs on other devices
- 7.8bpf: Skip unsettled links in link iterator
- 7.8bpf: Use array_map_meta_equal for percpu array inner map replacement
- 7.8xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()
- 7.8esp: downgrade zerocopy managed frags before mutating skb frags
- 7.8RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept
- 7.8RDMA/rxe: validate access flags before swapping the MR's PD
- 7.8xfrm: hold net_device reference under RCU in bundle creation
- 7.8RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths
- 7.8wifi: cfg80211: don't free driver-owned scan requests
- 7.8dmaengine: pxa: fix double counting of the hw descriptors
- 7.8netfilter: flowtable: hold reference on ct until flow is released
- 7.8smb: client: validate absolute native symlink targets before NT fixups
- 7.8ntfs: protect runlist updates with the runlist lock
- 7.8wifi: virt_wifi: don't transfer operstate before register
- 7.8net: dsa: mxl862xx: disable the stats poll on teardown
- 7.8futex: Also allocate private hash on vfork()
- 7.8net: lock the socket in sock_gettstamp()
- 7.8posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list
- 7.8signal: Prevent exec() race
- 7.8RDMA/ucma: Serialize join and leave on copy_to_user failure
- 7.8swiotlb: use the adjusted address for the highmem page lookup
- 7.8openvswitch: avoid reallocating confirmed conntrack labels
- 7.8ipv6: xfrm: use full sockets in local error paths
- 7.8mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ
- 7.8xfrm: save input state data before secpath resets
- 7.8drm/ttm: fix swapped-out resources never leaving their bulk_move range
- 7.5gve: fix XSK buffer leak on error descriptor
- 7.5net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()
- 7.5ice: Restore Ordered MMIO Writes for Tx Doorbells
- 7.5dpaa2-switch: fix the error path in dpaa2_switch_rx()
- 7.5llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
- 7.5tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow
- 7.5net/mlx5e: fix swapped IPv6 IPsec policy masks
- 7.5scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
- 7.5net: iptunnel: fix stale transport header during tunnel decapsulation
- 7.5Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup
- 7.5rds: ib: use rds_conn_drop() on protocol version mismatch
- 7.5smb: client: cancel reconnect work in clean_demultiplex_info()
- 7.5smb: client: fix rlist race and missing initialization
- 7.4EDAC/altera: Fix use-after-free in error paths
- 7.3pfcp: make sure the SEID is linear before reading it
- 7.3bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir
- 7.1Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()
- 7.1drm/nouveau: RCU-free the scheduler-containing nouveau_sched
- 7.1HID: alps: fix use-after-free on input2 registration failure
- 7.1netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
- 7.1KVM: SEV: Do cache maintenance on the source VM during intra-host migration
- 7.1KVM: arm64: Fix AArch32 DBGBXVR<n> handling
- 7.1wifi: libipw: reject too-short beacon and probe responses
- 7.1wifi: libipw: reject too-short association responses
- 7.1dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3
- 7.1IB/hfi1: Fix the PIO_CRED credit-return mmap
- 7.1drm/msm: RCU-free the scheduler-containing ring and VM objects
- 7.0riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE
- 7.0ext4: don't enable large folios on encrypted inodes
- 7.0KVM: arm64: nv: Fix life cycle of the nested_mmus array
- 7.0net/mlx5: HWS, Handle destroying table that has a miss table
- 7.0drm/nouveau/dmem: pin VRAM for the whole registered range
- 7.0RISC-V: KVM: Serialize IMSIC attributes with vCPU migration
- 7.0KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction
- 7.0drop_monitor: fix out-of-bounds write in reset_per_cpu_data()
- 7.0RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds
- 7.0RDMA/core: Reject unregistering netdevs in ib_get_eth_speed
- 7.0wifi: mac80211: unlist vifs when their netdev is unregistered
- 7.0wifi: cfg80211: get the wiphy out of a dying network namespace
- 7.0RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()
- 7.0xfrm: use hlist_del_init_rcu for state_cache and state_cache_input
- 7.0hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove
- –io_uring/zcrx: fix buffer offsets in areas above 4GB
- –io_uring/napi: make stale entries time out after 60s
- –io_uring: wake ring pollers for local task_work
- –io_uring/openclose: keep the lock in io_pipe_fixed()
- –io_uring/timeout: don't lose a cancel as io-wq arms a timeout
- –io_uring/poll: avoid retry wakeup loss when dropping ownership
- –ntfs: fix resident conversion in ntfs_new_attr_flags
- –drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction
- –dm cache: fix issue with background work locking
- –gpio: shared: gracefully handle no-device lookup of shared GPIOs
- –x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()
- –soc/tegra: pmc: Fix uninitialised clock rate
- –io_uring/io-wq: don't hide a link from cancellations
- –io_uring/mpscq: disable preemption while pushing
- –io_uring/cancel: rearm local work wake up before sleep
- –io_uring: don't flood a cancelling task with task_work
- –printk: Postpone kthread startup
- –Drivers: hv: Avoid infinite retry loop in init_vp_index()
- –tracing: Do not initialize tracefs work if tracing is disabled
- –i2c: xiic: restore non-managed runtime PM to fix clk WARN flood
- –pid_namespace: make zap_pid_ns_processes() freezable
- –KEYS: Fix key_reject_and_link() race with keyring restriction
- –pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
- –io-wq: order the exit bit against worker creation task work
- –dm-integrity: fix buffer overflow in inline mode with large tag size
- –io_uring/register: don't exempt disabled rings from task restrictions
- –tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
- –mm: don't schedule deferred kernel page table freeing while booting
- –riscv: patch: fix handling of bpf-jit execmem addresses
- –drm/amdgpu: serialize vblank counter reads against GPU reset
- –dm-integrity: fix NULL pointer dereference when the 'R' flag is used
- –dm-integrity: validate the superblock on resume
- –sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler
- –readdir: take no inode lock on an immutable directory
- –ipv6: udp: Create exceptions before socket matching
- –rust_binder: reschedule node refcount update on thread exit
- –ipv4: stop exception dump when nexthop group shrinks
- –Input: ati_remote2 - fix type confusion in device attribute handlers
- –ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers
- –can: dev: init_can_skb(): restore skb header initialization
- –cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()
- –vsock/virtio: account only unread bytes in read_skb()
- –wifi: mt76: mt7603: initialize global station WCID
- –tcp: reject net_iov in zerocopy receive mapping hints
- –gve: fix napi_disable deadlock when attempting to disable XSK pools
- –gve: fix XSK buffer leak when rings are stopped
- –ice: fix use-after-free in dynamic port cleanup
- –net: sparx5: free the matchall entry on destroy
- –net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop
- –net: team: free skb when broadcast has no txable port
- –power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()
- –regulator: of: fill in supply names in of_regulator_bulk_get_all()
- –regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4
- –drm/imagination: Size page table preallocation by device address
- –drm/panthor: validate userspace queue count against initialized firmware slot count
- –drm/xe/i2c: cancel the client work on remove
- –drm/xe: Fix shrinker accounting double-subtraction on nested external pins
- –drm/bridge: th1520-dw-hdmi: Fix remove() callback
- –drm/amdgpu/userq: only accept doorbell BOs as queue doorbell
- –fs: don't silently unmount busy mounts
- –statmount: read the parent of an unmounted mount under mount_lock
- –namespace: check a recursive bind mount for mount namespace loops
- –namespace: look at the topmost mount for a mount namespace file
- –namespace: remove the fsnotify marks of a mount namespace in process context
- –unshare: don't drop active namespace references that were never taken
- –drm/bridge: Fix unlocked list_del in drm_bridge_add()
- –cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()
- –bonding: fix the program leak when XDP is replaced
- –btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio
- –btrfs: free iov when btrfs_uring_read_extent() fails
- –btrfs: unlock inode and extent in caller when io_uring read extent fails
- –btrfs: don't stash io_uring encoded data across -EAGAIN
- –wifi: mt76: account non-AQL frames per peer rather than per link
- –wifi: mt76: mt7915: disable rx napi when removing device
- –devlink: fix devlink_rel reference leak when notify work is pending
- –net: always dissect GSO packets in __virtio_net_hdr_to_skb()
- –riscv: ptrace: Zero-initialize regset buffers before copyin
- –mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()
- –drm/imagination: Fix reference and vm_bo handling in remap()
- –vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
- –drm/vc4: Disable the V3D interrupt across runtime suspend
- –HID: steam: Clean up locking
- –sched_ext: Build the cid tables privately and publish them with RCU
- –x86/mm: Drop unnecessary PMD page copy when freeing
- –rust: irq: pass RegistrationInner as cookie to request_irq
- –perf/core: Check kernel access when kernel callchains are requested
- –KVM: s390: Fix IRQ injection with SIGP Stop and Store Status
- –macsec: initialize SecY before registering the netdevice
- –KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2
- –drm/amd/display: Remove sink usage from DPMS
- –bpf, sockmap: Fix self-redirect copied_seq double-counting
- –fs: avoid repeated scans in evict_inodes()
- –arm64: io: Reject non-user protection in ioremap_prot()
- –net: emac: move setting of netops to fix crash
- –ovl: fix UAF in ovl_do_mkdir() debug print
- –netfs: Fix missing alloc tagging of direct mempool allocations
- –drm/xe: harden adjust_idledly() against divide-by-zero and overflow
- –mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold()
- –parisc: Increase kernel stack size to 32kb
- –wifi: nl80211: check link is beaconing for color change
- –media: video-i2c: use vb2_video_unregister_device on driver removal
- –drm/amdgpu: cap ATOM command table nesting depth
- –net: thunderx: fix PTP device ref leak in nicvf_probe()
- –ALSA: seq: oss: Reject reads that cannot fit the next event
- –drm/amdkfd: Unwind debug trap enable on copy_to_user failure
- –net: cpsw_new: unregister devlink on port registration failure
- –net: microchip: sparx5: clean up PSFP resources on flower setup failure
- –btrfs: protect sb_write_pointer() with invalidate lock
- –net: lan966x: restore RX state on reload failure
- –drm/amdkfd: Properly acquire queue buffers in CRIU restore
- –mailbox: imx: Use devm_pm_runtime_enable()
- –mailbox: imx: Add a channel shutdown field
- –md/raid5: let stripe batch bm_seq comparison wrap-safe
- –ksmbd: fix lease break and ack state handling
- –xen/gntalloc: validate grant count before allocation
- –drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized
- –ksmbd: don't hold ci->m_lock while waiting for a lease break ack
- –thunderbolt: Keep the domain reference while processing hotplug
- –drm/amd/ras: reset CPER ring on corrupt entry size
- –firmware: arm_scmi: Validate SENSOR_UPDATE payload size
- –firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size
- –wifi: mac80211: validate deauth frame length before reason access
- –wifi: libertas: reject short monitor TX frames
- –arm64: kprobes: Allow reentering kprobes while single-stepping
- –wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO
- –drm/gma500: return errors from Oaktrail HDMI I2C reads
- –ima: return error early if file xattr cannot be changed
- –mmc: core: Add validation for host-provided max_segs
- –serial: 8250_port: recognize UPIO_AU
- –media: chips-media: wave5: Add range checks for dec_output_info
- –net: bridge: remove stale rcu_barrier() in br_multicast_dev_del()
- –ntfs3: handle set_blocksize failures
- –isofs: handle set_blocksize failures
- –irqchip/gic-v5: Immediately exec priority drop following activate
- –irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed
- –host1x: bus: Fix missing ops null check in error teardown
- –drm/nouveau/gsp: add SEC2 to GA100 chip table
- –wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect
- –netfilter: nf_conntrack_expect: zero at allocation time
- –freevxfs: don't BUG() on unknown typed-extent type
- –crypto: ccp - Fix possible deadlock in SEV init failure path
- –dm-pcache: reject a kset that overruns its segment
- –dm-pcache: bound the logical key offset from persistent memory
- –sched/cache: Introduce task_struct->sched_cache_grp to fix UAF
- –sched_ext: Don't run ops.dequeue() with a DSQ lock held
- –sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task
- –KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails
- –fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()
- –HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request
- –HID: multitouch: stop the release timer from being rearmed on remove
- –io_uring: fix task_work add use-after-free with SQPOLL
- –net: extend IPv6 exthdr detection of tunneled packets
- –pfcp: fix socket lifetime on netdevice registration failure
- –rtc: ac100: Assign .num before accessing .hws
- –tpm: Disable TPM on null key name mismatch
- –netfs: clear post-EOF pagecache when extending a file via write
- –netfs: zero gaps in read-gaps folio to avoid writing back stale data
- –module: fix lost error code from codetag_load_module()
- –virt: vmgenid: set driver_data before registering notification handlers
- –vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()
- –iio: accel: kionix-kx022a: Fix array boundary check
- –mtd: core: avoid double-free of OTP NVMEM device
- –blk-cgroup: save IRQ state in blkg_tryget_closest()
- –wifi: mac80211: drop oversized fragments to avoid extra_len overflow
- –wifi: ath9k: reject short WMI command responses
- –wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE
- –rtc: ac100: Fix clock provider use-after-free on probe failure
- –wifi: mac80211: validate TX status rate metadata
- –wifi: mac80211: prevent AP VLAN tx from other interfaces
- –block: reject polled dio with user integrity metadata
- –blk-mq: set RQF_USE_SCHED when the operation is known
- –mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()
- –ASoC: SDCA: Add better pm_runtime error handling in func probe
- –bpf: Fix overflow of jump offset in constant blinding
- –nvme: fix cdev lifetime
- –nvme: fix command effects log lifetime for multipath heads
- –bpf: Hold map BTF for the memory allocator destructor record
- –wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()
- –net: systemport: Fix buffer overflow in bcm_sysport_get_stats()
- –net/mlx5: Fix slab-out-of-bounds when handling team device events
- –octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled
- –net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()
- –net: stmmac: fix rx Scatter-Gather support
- –seg6: ensure packet data is writable before modifying SRH and IPv6 DA
- –net: restrict SO_RESERVE_MEM to TCP sockets and cap max value
- –bpf: Wait for an RCU tasks grace period before freeing trampoline progs
- –bpf: Skip detached progs in trampoline images that are still in use
- –net: cap skb->queue_mapping when the tx queue is picked
- –net: ethernet: mtk_eth_soc: allocate dummy netdev sooner
- –net: sparx5: skip ptp deinit if init was skipped
- –netfilter: flowtable: generalize pending status bit
- –net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference
- –bpf: Fix objects stuck in free_by_rcu_ttrace
- –futex: Fix private hash use-after-free on resize
- –bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()
- –drm/amd/display: guard dc_sink dereferences in MST mode validation
- –drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device
- –drm/mediatek: Fix ovl adaptor platform device leak
- –drm/mediatek: Fix pdev reference leak in mtk_drm_bind()
- –binderfs: fix UAF write in binder_add_device
- –rust_binder: cancel deferred work items in thread exit
- –usb: gadget: midi2: Fix the jack descriptor array sizes
- –usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()
- –usb: typec: ucsi: glink: fix use-after-free of ucsi on remove
- –serial: core: fix NULL pointer dereference in serial_core_unregister_port()
- –serial: ma35d1: Fix clock reference leak in ma35d1serial_probe()
- –ASoC: codecs: max98363: fix uninitialized stream_config->type
- –ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type
- –EDAC/altera: Drop __init from ECC setup paths for re-probe safety
- –Bluetooth: Serialize SMP remote OOB data access
- –Bluetooth: hci_sync: Fix inquiry cache use-after-free
- –Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown
- –Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()
- –Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()
- –x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h
- –tpm: fix off-by-four bounds check in tpm2_get_random()
- –nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known
- –nvmet: pci-epf: reject too-short SGL segments
- –nvmet: copy the hostid into the ctrl before creating PR pc_refs
- –KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified
- –KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it
- –KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state
- –KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy
- –KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded
- –KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN
- –KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT
- –KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq
- –wifi: mac80211: reject invalid 320 MHz CSA bandwidth
- –wifi: mac80211: fix mesh fast xmit path deletion UAF
- –thunderbolt: Hold a router reference for each allocated HopID
- –thunderbolt: Make the DP tunnel activation callback mandatory
- –thunderbolt: Tear down inactive DP tunnels when the domain is stopped
- –thunderbolt: Fix domain reference leak when DPRX read is canceled
- –thunderbolt: Don't access a DP tunnel after its DPRX read was canceled
- –thunderbolt: Fix NULL dereference in tb_remove_work()
- –smb: client: discard post-EOF pagecache when extending a file via clone range
- –smb: client: flush and commit data before querying allocated ranges
- –smb: client: flush dirty data before zeroing a range
- –smb: client: drain and invalidate before server-side copy/clone
- –iio: accel: kionix-kx022a: Prevent memory leak and fix state
- –iio: adc: ad4030: fix invalid oversampling_ratio validation
- –iio: adc: ade9000: fix NULL pointer dereference in clkout registration
- –iio: adc: ade9000: handle Phase C dip events in IRQ1 handler
- –iio: adc: adi-axi-adc: Initialize state mutex
- –iio: adc: pac1934: check ACPI label duplication
- –iio: frequency: adf4377: Fully initialize clk_init_data and clk_parent_data
- –iio: health: max30102: fix NULL dereference in interrupt handler
- –iio: light: rohm-bu27034: Fix infinite delay on error
- –iio: pressure: rohm-bm1390: Return error when read fails
- –iio: proximity: aw96103: validate firmware data length
- –drm/amd/display: Atomize IRQ register read/modify/write ops
- –KVM: s390: Fix _gaccess_shadow_fault()
- –KVM: s390: Add missing srcu in kvm_s390_set_irq_state()
- –KVM: s390: Fix potential races in dat skey functions
- –KVM: s390: Properly handle NULL pointer in dat_cond_set_storage_key()
- –KVM: s390: Fix race in _destroy_pages_crste()
- –s390/uv: Prevent potential out-of-bounds read
- –bpf: Fix divide-by-zero in btf_struct_walk()
- –tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context
- –HID: winwing: fix use-after-free in force feedback teardown
- –bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()
- –bpf: Fix out-of-bounds read of rtt_min in sock_ops
- –bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk
- –bpf, arm64: set up the frame pointer for the exception callback
- –HID: amd_sfh: Validate PCI BAR size before mapping
- –KVM: riscv: Fix NACL hfence entry update order
- –KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()
- –KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure
- –squashfs: Add dictionary size range check to prevent shift-out-of-bounds
- –scsi: block: Fix zones_cond out-of-bounds write on zone report
- –scsi: sd_zbc: Reject disks with too many zones
- –Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()
- –Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
- –xsk: Use a 32-bit compare in xsk_map_gen_lookup
- –eth: fbnic: Fix payload page pool error cleanup
- –net/sched: cls_u32: fix manual hash table handle IDR aliasing
- –bpf: Make post-verification instruction rewrites killable
- –bpf: Preserve packet pointer class displacement in regsafe()
- –bpf: Restrict CO-RE poisoning to relocatable instructions
- –netfilter: flowtable: publish HW_DEAD after worker is done
- –netfilter: nfnetlink_queue: hold nfnl mutex in event notifier
- –drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
- –net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure
- –net: gue: reject invalid REMCSUM offsets
- –net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure
- –net: ethtool: keep rtnl_lock for the ioctl self test
- –eth: fbnic: Handle maximum standalone channels
- –eth: fbnic: use the Rx queue napi pointer to find the napi vector
- –eth: fbnic: reset num_napi when the napi vectors are freed
- –eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox
- –sctp: avoid livelock while updating retransmit path
- –bpf: Bound ownership depth through local kptrs and graph roots
- –net: usb: catc: bound the RX packet length in catc_rx_done()
- –bpf: Check params size before reading reserved fields
- –net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget
- –drm/virtio: fix object leak when drm_gem_handle_create() fails
- –drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
- –drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()
- –drm/virtio: release the GEM object on virtio_gpu_vram_create() errors
- –drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach
- –ovpn: replace bind when learning local endpoint
- –ovpn: replace bind when clearing stale local source
- –Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough
- –Bluetooth: btintel_pcie: validate device-supplied DMA indices
- –Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()
- –ipv6: Prevent rt6_insert_exception() for dying fib6_info.
- –bpf: Reject non-negative offsets in stack_slot_obj_get_spi()
- –net: usb: sr9700: include receive overhead in the length check
- –ipv6: Fix dst leak for uncached routes.
- –udp: remove a disconnected socket from the 4-tuple hash table
- –tg3: clean up PHYLIB resources on probe failure
- –s390/debug: Fix NULL pointer dereference in debug_info_copy()
- –net: spacemit: clear TX descriptor on fragment mapping failure
- –bpf: Fix bounds check for skb-backed dynptrs
- –bpf: Fix bpf_sock context code generation
- –bpf: Reject pkt arguments in mutating subprogs
- –firewire: cdev: fix back-transition for iso_resource_auto client resource
- –bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc
- –sctp: hold asoc or transport before mod_timer() in timer handlers
- –eth: fbnic: Avoid rounding zero ring sizes
- –net/sched: fix potential stack infoleak in em_text_dump()
- –nfc: nfcmrvl: validate helper command length before pull
- –nfc: st21nfca: validate received frame size
- –nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
- –nfc: llcp: Fix race condition in accept_queue lifecycle
- –nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure
- –nfc: st21nfca: validate ISO15693 inventory length
- –nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
- –nfc: llcp: fix slab-out-of-bounds reads when logging service names
- –nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
- –net: bcmgenet: stop Tx NAPI before disabling the queues
- –bpf: Fix immediate JMP JEQ/JNE on MIPS32
- –net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
- –net: stmmac: clear stale buf->page after recycling on skb build failure
- –net: ipv6: keep room for the mac header in dst_dev_overhead()
- –ip_gre: Reject enabling collect metadata through changelink
- –net: xps: reject an out of range traffic class
- –drm/imagination: clamp freelist reconstruction requests
- –net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq
- –net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621
- –net: phylink: record the PHY only once bringup cannot fail
- –net: libwx: fix races in Tx timestamp handling
- –nfp: hold IPsec RX state under the XArray lock
- –net/rds: size a connection's path set by the transport it ends up with
- –net/smc: fix UAF on lgr list traversal in smcr_port_err()
- –net: flush skb_defer_nodes in dev_cpu_dead()
- –gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO
- –gve: DQO: reject TSO packets with an out of range MSS
- –vlan: ensure sufficient headroom in vlan_dev_hard_header()
- –autofs: fix sbi->pipe file reference leak in autofs_kill_sb()
- –perf/core: Fill branch entries with a single assignment
- –perf/core: Fix a refcount leak in attach_perf_ctx_data()
- –af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
- –arm64/boot: Disable trapping of PMZR_EL0 writes to EL2
- –ata: libata-scsi: bound the ATA passthru sense descriptor writes
- –cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict
- –fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT
- –fprobe: Terminate the fgraph_data list when the reservation is not filled
- –fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga
- –workqueue: Fix NULL current_pwq deref in flush dependency check
- –writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes
- –writeback: report a Tasks-RCU quiescent state per cgwb drain pass
- –fsl/fman: Fix clk reference leak in read_dts_node()
- –ipe: fix use-after-free when auditing a newly loaded policy
- –ipe: protect the dm-verity root hash with RCU
- –ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
- –kprobes: Fix permanent hang when flushing the kprobe optimizer
- –gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()
- –gpio: cdev: fix kernel stack leak to user-space in error path
- –gpio: zynq: fix runtime PM leak on request error path
- –llc: reserve device headroom for allocated frames
- –mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()
- –drm/client: fix restore of partially initialized client
- –drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()
- –drm/i915: fix incorrect RCU teardown order
- –drm/nouveau: Fix bridge reference leak in nv1a_ram_new()
- –drm/nouveau: Fix gem reference leak in validate_init()
- –drm/nouveau: Fix runtime PM leak in nouveau_connector_detect()
- –drm/virtio: fix memory leak of fence event on execbuffer failure
- –drm/virtio: fix NULL pointer dereference on fence allocation failure
- –mm/hugetlb: do not dissolve gigantic pages without runtime support
- –mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()
- –PCI: of_property: Omit bus properties without a subordinate bus
- –packet: use ubuf_info completion for TX_RING packets
- –HID: hid-oxp: use cancel_delayed_work_sync() in remove
- –net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
- –net: airoha: npu: cancel wdt_work after releasing the WDT IRQ
- –net: arp: terminate device name before lookup
- –net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
- –net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths
- –net: atl1c: fix soft lockup on out-of-range tpd_cons read
- –net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
- –nfc: fix use-after-free in nfc_get_local_general_bytes
- –nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
- –nfc: port100: reject frames whose declared length exceeds the received data
- –nfc: trf7970a: power down on startup RX gain failure
- –scsi: ufs: core: Keep internal commands dispatchable during error handling
- –perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()
- –s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()
- –s390/cmf: Fix virtual vs physical address confusion
- –s390/pci: Fix missing device lock in zpci_report_status()
- –s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config
- –KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV
- –KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode
- –KVM: arm64: Fix spurious warning for benign stage 2 teardown race
- –KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race
- –sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags
- –Bluetooth: hci_conn: fix CIS hold ownership on reuse
- –Bluetooth: hci_sock: validate event length before filtering
- –Bluetooth: hci_sock: reject out-of-range OCF values
- –Bluetooth: ISO: balance the parent hold in hci_bind_bis()
- –Bluetooth: ISO: release unused CIS holds after channel attach
- –Bluetooth: L2CAP: validate frame length before control and FCS access
- –Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
- –smb: client: clean up failed cached directory opens
- –smb: client: delete compound mids on send failure before unlock
- –xfs: release orphanage dir inode if chown fails
- –xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots
- –xfs: don't let hidden_space go negative in xfs_metafile_resv_init
- –xfs: don't let memory failures leak blocks and kill repairs
- –xfs: drop dquot flush lock when we can't find a buffer to flush
- –smb/server: cancel async requests when closing connection
- –mptcp: options: fix uninit-value in mptcp_write_data_fin
- –media: qcom: iris: fix runtime PM reference leaks
- –EDAC/altera: Use parent device for devres in altr_portb_setup()
- –sysctl: Check range in proc_dointvec_ms_jiffies_minmax
- –KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure
- –RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency
- –RDMA/efa: Keep admin queues alive while IRQ is registered
- –ALSA: usb: 6fire: Avoid embedded URBs
- –RDMA/efa: Keep EQ resources alive while IRQ is registered
- –wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path
- –net/sched: codel: bound the dropping loop per dequeue call
- –wifi: mac80211: don't warn when an IBSS has no channel to scan
- –wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping
- –wifi: cfg80211: undo netns switch if renaming the wiphy fails
- –wifi: mac80211: require a peer station for TDLS setup confirm
- –wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown
- –ksmbd: follow SMB2 session expiration semantics
- –sched/core: Avoid false migration warning for proxy donors
- –dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()
- –net: xfrm: reject unrepresentable espintcp transport headers
- –memcg: avoid charging the root memcg from obj_cgroup_charge_pages()
- –soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node
- –selinux: always fill AVC decision in avc_has_perm_noaudit()
- –power: sequencing: fix NULL-pointer dereference in pwrseq_device_register()
- –power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new()
- –watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog
- –watchdog: rzv2h: Avoid division by zero
- –wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver
- –wifi: rsi: fix heap OOB write on key removal
- –drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
- –net: icmp: avoid invalid transport header access in icmp_send tracepoint
- –s390/boot: Avoid IPL parameter append past command line
- –s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block
- –s390/ipl: Fix NULL deref in kdump without re-IPL parm block
- –platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown
- –locking/lockdep: Invalidate stale class_cache entries for zapped classes
- –powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare()
- –af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.
- –powerpc/entry: Fix irq_soft_mask corruption on replayed interrupt exit
- –Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one
- –net: ipv4: Fix UDP length overflow with PMTU discover and big MTU
- –drm/xe: Guard page-fault worker with runtime PM check
- –x86/amd_node: Avoid divide by zero on virtualized systems
- –exec: do_close_on_exec() before taking exec_update_lock
- –drm/amdgpu: skip gfx switch_power_profile during GPU reset
- –s390/crypto: Fix skcipher_walk return code handling in aes_s390
- –bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
- –net/sched: reject IDR error pointers when deleting actions
- –netfilter: ip6t_rpfilter: reject routes without inet6_dev
- –xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()
- –xfrm: iptfs: fix runt reassembly panic from short inner tot_len
- –xfrm: fix compat ALLOCSPI request use-after-free
- –firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
- –clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
- –IB/iser: reject a remote invalidation of an unregistered direction
- –RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup
- –RDMA/rtrs: guard against null kobj name
- –RDMA/mad: Fix receive buffer leak when PKey enforcement fails
- –RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted
- –wifi: virt_wifi: free skb when disconnected
- –wifi: brcmfmac: cyw: pass PMKID to firmware if present
- –IB/IPoIB: Avoid restoring OPER_UP after multicast flush
- –wifi: cfg80211: don't get the radio mask for netdev-less wdevs
- –wifi: cfg80211: check IP header size in cfg80211_classify8021d()
- –dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()
- –dmaengine: Fix device kref underflow in dma_chan_put()
- –dmaengine: wait for RCU readers before releasing dma_device
- –wifi: cfg80211: only group hidden BSSes with beacon entries
- –wifi: cfg80211: ibss: ref BSS entry for joined event
- –wifi: mac80211: don't start a ROC while scanning
- –wifi: mac80211: don't offload TC setup on AP_VLAN interfaces
- –wifi: mac80211: abort chanswitch when leaving a mesh
- –wifi: mac80211: reset the LED state when ifup fails
- –wifi: mac80211: reset state when starting AP fails
- –wifi: mac80211: only operate on TDLS peers in the TDLS code
- –wifi: mac80211: add HE 6 GHz capability in the scan elems len
- –wifi: mac80211: don't allow injecting frames wider than the chanctx
- –wifi: mac80211: mesh: reset the CSA state when leaving
- –wifi: mac80211: mesh: release the channel if start fails
- –wifi: mac80211: set up the TX info early to fix failure paths
- –netfilter: nft_nat: fully initialise new_addr in netmap setup
- –netfilter: nf_nat: unregister and release hooks on error
- –drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr
- –neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.
- –ALSA: bcd2000: Fix race between rawmidi and disconnect
- –drm/msm/dp: skip PUSH_IDLE when the link was never enabled
- –ALSA: pcm: set timer->private_data before registering the PCM timer
- –ALSA: 6fire: fix OOB write from device-reported iso length
- –drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory
- –ALSA: hda: trace PCM open only after assigning a stream
- –drm/vc4: Use managed KMS polling to fix UAF on unbind
- –wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()
- –seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation
- –net: bcmgenet: restore the hardware filters on open
- –ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup
- –net: fddi: skfp: fix NULL deref when setting the MAC address while down
- –tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().
- –net: bridge: mst: move switchdev call outside rcu
- –tcp: do not let tcp_rmem be set below 4096
- –dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()
- –Bluetooth: btintel_pcie: validate TX skb length in send_sync
- –Bluetooth: coredump: Quiesce dump work on unregister
- –Bluetooth: hci_qca: Do not write to the serial port after it is closed
- –Bluetooth: ISO: Fix parent socket leak in iso_conn_ready()
- –Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit
- –Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access
- –af_unix: Unify scc_index when finalising SCC in __unix_walk_scc().
- –net: stmmac: fix TSO header length truncation
- –drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown
- –pppoatm: ensure a writable skb header and linear data
- –net: bridge: vlan: fix bugs caused by switchdev deletion errors
- –netlink: do not free nlk->groups while lockless readers can use it
- –btrfs: handle lack of space when cleaning up verity items
- –drm/xe/i2c: Disable IRQ on unbind
- –net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check
- –eth: fbnic: ring the doorbell if a burst ends in a drop
- –net: ethernet: cortina: Ack RX overrun interrupt correctly
- –net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb()
- –x86/kprobes: Fix crash when probing CS CALL instructions
- –net: skbuff: do not leave stale header offsets after pskb_carve()
- –net: mvpp2: prevent buffer overflow in page_pool allocation
- –drm/amdgpu: check ras and obj before dereference
- –btrfs: abort transaction on failure to update inode for hole punching and reflinking
- –9p: Fix v9fs_issue_write() to update i_size and remote_i_size
- –perf: Fix null pointer access in is_include_guest_event()
- –ALSA: core: Fix potential UAF after asynchronous card release
- –ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY
- –ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type
- –fs/dax: check zero or empty entry before converting xarray entry
- –tcp: exclude old ACKs from tcp fast path
- –nfsd: fix handling of NFSEXP_PNFS in the netlink codepath
- –arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc
- –Bluetooth: hci_codec: validate vendor codec count length
- –arm64: percpu: Fix LSE operations on {8,16}-bit types
- –Bluetooth: hci_sync: Serialize local codec list cleanup
- –btrfs: clear free space tree creation state on rebuild failure
- –dma-buf: Fix silent overflow for phys vec to sgt
- –net: ip_tunnel: initialize `options_len` before referencing options
- –net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain
- –net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()
- –net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value
- –net/sched: hhf: cap hh_flows_limit at change time
- –net/sched: act_api: release tail references on DELACTION failure
- –net/packet: clear RX owner on VNET header error
- –xfrm: serialize state GC with device state flush
- –scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()
- –memstick: ms_block: destroy io_queue workqueue on removal
- –mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count
- –mm/shrinker: fix bogus set_shrinker_bit() with cgroup.memory=nokmem
- –mm/vma: correctly unaccount on mmap_prepare() failure
- –mm: filemap: retain mapped dropbehind folios
- –KEYS: encrypted: fix integer overflow of datablob_len
- –KEYS: trusted: Fix tpm2_load_cmd() boundary check
- –sched_ext: Fix NULL sched deref in kfunc sub-sched error paths
- –i2c: atr: fix dangling adapter pointer on add failure
- –sched_ext: Close the pre-enable ops error claim window
- –IB/mlx4: Fix use-after-free on pkey sysfs registration failure
- –selinux: preserve user SID across nested backing files
- –selinux: recheck intermediate backing files on mprotect()
- –mmc: core: Cancel SDIO IRQ work before freeing host
- –mmc: hsq: Fix use-after-free in retry work
- –mmc: mmci: Fix use-after-free in busy-timeout work
- –mmc: mxcmmc: cancel data work and watchdog on remove
- –mmc: sdio_uart: fix xmit_fifo leak when the port table is full
- –mmc: sdhci-of-aspeed: Remove children before releasing SDC resources
- –mmc: spi: reset bytes_xfered before retrying CRC failures
- –Input: cyttsp5 - clamp the HID report size before memcpy
- –Input: evdev - zero absinfo before partial copy in EVIOCSABS
- –Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
- –Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound
- –Input: soc_button_array - check btns_desc->package.count
- –hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()
- –Input: zero ff_effect before compat copy in input_ff_effect_from_user
- –hwmon: (pmbus/core) increase number of phases and add new mask
- –wifi: brcmsmac: fix UAF in brcms_free_timer()
- –wifi: libertas_tf: fix UAF in lbtf_free_adapter()
- –wifi: iwlegacy: fix broadcast stations deallocation
- –wifi: wlcore: release runtime PM ref on regdomain config failure
- –wifi: wilc1000: fix out-of-bounds read in P2P public action frames
- –wifi: p54: validate curve data length in the calibration curve converters
- –wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()
- –wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST
- –wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length
- –wifi: mwifiex: validate scan response extents
- –wifi: mac80211: avoid out-of-bounds read for empty PREQ elements
- –wifi: mwifiex: prevent authentication frame length truncation
- –wifi: mac80211: refuse to make a monitor active when it has no queue
- –drm/gud: fix out-of-bounds write in gud_plane_atomic_check()
- –drm/amdgpu: fix rmmio iounmap skipped on device removal
- –drm/amdgpu: Skip KFD mapping clear before initialization
- –drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc
- –drm/amdkfd: Avoid integer underflow in EOP ring size calculation.
- –smb: client: fix reparse buffer bounds in cifs_query_reparse_point()
- –smb: client: fix server->total_read for compound encrypted PDUs
- –drm/amdgpu: restrict BAR0 fallback read to SR-IOV VFs only
vLLM
53 vulnerabilities · Servers and applications
- 9.8Untrusted EPS inputs can trigger denial of service or Ghostscript RCE in vLLM
- 9.2vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision
- 8.8vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector
- 8.8Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled
- 8.7vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override
Show 48 more
- 8.7vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass
- 8.7vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs
- 8.7MOSS-Audio request-controlled processor cache permits remote memory exhaustion
- 8.3vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors
- 8.2vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholders
- 8.2vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate
- 8.2vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_ids
- 8.2vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top_n
- 8.1Request-controlled mm_processor_kwargs.code_revision allows remote code execution
- 7.7Cross-tenant DoS via uninitialized LogprobsTensors with prompt_logprobs
- 7.5Unauthenticated EngineCore crash via out-of-range prompt token id under skip_tokenizer_init (incomplete fix of GHSA-25q3-v2hm-8vpf)
- 7.5Missing request-wide media budget allows single-request frontend resource exhaustion
- 7.5Remote DoS in vLLM via allowed_token_ids Speculative-Decoding Metadata Mismatch
- 7.5DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)
- 7.1vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids
- 7.1vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions
- 7.1vLLM before 0.31.0 Cross-Request Cache Aliasing via EXIF ImageID and Prefix-Cache Keys
- 7.1vLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generate
- 7.1vLLM before 0.29.0 Heap Overflow DoS via IAMF Audio Transcription Upload
- 7.1Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine
- HighFrame-count cap bypass in VideoMediaIO.load_base64 for video/jpeg via media_io_kwargs.video.num_frames
- HighNemotron-VL processors disable Pillow decompression-bomb guard globally, enabling unauthenticated DoS
- HighSSRF via X-Request-Id header drives P2pNcclConnector outbound ZMQ+NCCL pair, leaking KV-cache tensors
- 6.5Incomplete CVE-2026-34755 remediation can be bypassed by request-level num_frames
- 6.5Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine
- 6.5DeepSeek-OCR family: an image whose normalized pixels sum to exactly 0 makes embed_multimodal return None, tripping the encoder-output sanity assert — one…
- 6.5Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)
- 6.5Responses API bypasses trust_request_chat_template for chat_template_kwargs
- 6.5DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool
- 6.5Unvalidated stop_token_ids causes engine crash (DoS) and out-of-bounds GPU write
- 6.5Multimodal chat audio decoding bypasses the decompression-bomb duration limit
- 6.5Caller-controllable values become or collide with shared cache keys, enabling cross-request cache aliasing (2 sites: multimodal EXIF hash and prefix-cache…
- 6.5An oversized min_tokens in one request hangs the vLLM engine while /health stays green
- 6.3vLLM before 0.31.0 Stale allowed_token_ids Mask via InputBatch.condense
- 5.9vLLM denial of service via prompt embeds on XD-RoPE models (incomplete fix of CVE-2026-55514)
- 5.9Remote DoS in disaggregated multimodal /inference/v1/generate via malicious kwargs_data / mm_placeholders
- 5.9Rust gRPC Generate accepts out-of-vocabulary prompt token IDs and can terminate EngineCore
- 5.9Rust gRPC output_candidates.token_ids bypasses logprob_token_ids limits and can terminate EngineCore
- 5.9Rust gRPC CandidateTokens.top_n bypasses max_logprobs and can terminate EngineCore
- 5.4vLLM Speculators Config verifier.name_or_path Element Directory Traversal Information Disclosure Vulnerability
- 5.3vLLM OpenCVDynamicOpenPanguVideoBackend: request-level num_frames without a ceiling — unauthenticated memory/CPU exhaustion (OOM-kill) on any video-capable…
- 5.3MiniMax M3 video preprocessing permits request-driven CPU resource exhaustion through min_pixels
- 5.3sanitize_message() address regex is lowercase-only and does not match PIL's uppercase __repr__, leaking live heap addresses to unauthenticated clients
- 5.3vllm-project vLLM Completions Request mamba_mixer2.py conv_ssm_forward out-of-bounds
- 4.7vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server
- MediumQuadratic Cohere2 Vision preprocessing DoS via request-controlled max_patches
- 3.7V1 InputBatch.condense leaves a stale allowed_token_ids mask on recycled batch rows
- 2.1vllm-project vLLM Penalty utils.py get_token_bin_counts_and_mask denial of service
PHP object injection in WordPress themes
49 vulnerabilities
Show 44 more
- 9.8Kicker
- 9.8Original
- 9.8Anesta
- 9.8FC United
- 9.8ShiftCV
- 9.8Education Center
- 9.8Windsor
- 9.8Drone Media
- 9.8Asia Garden
- 9.8Invetex
- 9.8N7 | Golf Club Sports & Events
- 9.8Law Office
- 9.8WineShop
- 9.8Equadio
- 9.8Juno
- 9.8Avala
- 9.8Kalles
- 9.8Yacht Rental
- 9.8Wine House
- 9.8Tipsy
- 9.8Splendour
- 9.8Stargaze
- 9.8CleanSkin
- 9.8Booklovers
- 9.8Gutentype
- 9.8Dwell
- 9.8Convex
- 9.8Camelia
- 9.8Hygia
- 9.8Hogwords
- 9.8Greeny
- 9.8Edema
- 9.8Partiso
- 9.8Let's Play
- 9.8IPharm
- 9.8Tantra
- 9.8Smash
- 9.8Smart Casa
- 9.8Rosalinda
- 9.8Travesia
- 8.8Angio
- 8.8Neo | Barber Shop WordPress
- 8.8ColorFolio
- 8.1Haaken
Gitea
48 vulnerabilities · Servers and applications
- 9.8Gitea Org-mode file disclosure and code execution
- 8.8Gitea reusable workflow secret exposure in pull_request_target
- 8.8Gitea second-factor bypass through OpenID identity linking
- 8.8Gitea fork workflow approval bypass through review events
- 8.1Gitea cross-site request forgery on repository topics
Show 43 more
- 8.1Gitea API token scope escalation through HTTP signatures
- 8.1Gitea fork workflow approval bypass through concurrency cancellation
- 8.1Gitea API team demotion not applied to unit permissions
- 7.5Gitea external renderer argument injection and code execution
- 6.5Gitea API disclosure of private user social graph, keys and stars
- 6.5Gitea private profile information disclosure through POST request
- 6.5Gitea Actions artifact v4 API unbounded request body
- 6.5Gitea repository ownership escalation by administrators
- 6.5Gitea private comparison disclosure with public-only tokens
- 6.5Gitea required Actions check bypass through skipped workflows
- 6.5Gitea Swift package manifest memory exhaustion
- 6.5Gitea Alpine package parsing memory exhaustion
- 6.5Gitea GitLab migration denial of service
- 6.5Gitea OneDev migration denial of service
- 6.5Gitea organization team policy bypass through repository API
- 6.3Gitea release attachment re-linking of issue attachments
- 5.9Gitea private attachment disclosure through repository mismatch
- 5.8Gitea local code execution through writable Git hooks
- 5.4Gitea OpenID account linking without session binding
- 5.4Gitea private migration creation with public-only tokens
- 5.4Gitea organization repository creation token scope bypass
- 5.3Gitea panic on the repositories route of individual users
- 5.3Gitea blind SSRF through OpenID assertion verification
- 5.3Gitea hidden-owner repository listing disclosure
- 5.3Gitea private reusable workflow disclosure to fork runs
- 5.3Gitea OpenID discovery server-side request forgery
- 4.3Gitea draft release creation disclosing attachment metadata
- 4.3Gitea watched repositories API disclosure after access revocation
- 4.3Gitea reactions accepted on locked issues and comments
- 4.3Gitea Maven checksum upload quota bypass and memory exhaustion
- 4.3Gitea repository initialization resource exhaustion
- 4.3Gitea private workflow badge token scope bypass
- 4.3Gitea private pull request title disclosure through markup
- 4.3Gitea organization listing token scope bypass
- 4.3Gitea restricted-user SSH and GPG key metadata disclosure
- 4.3Gitea restricted-user issue search disclosure
- 4.3Gitea restricted-user activity and heatmap disclosure
- 4.3Gitea restricted-user organization metadata disclosure
- 4.3Gitea restricted-user package visibility bypass
- 4.3Gitea private repository metadata disclosure after access revocation
- 4.3Gitea profile feed disclosure bypassing user visibility
- 3.5Gitea Jupyter notebook UI redress through CSS class injection
- 3.1Gitea label deletion across repository and organization IDs
PHP object injection in WordPress plugins
27 vulnerabilities
- 9.8Sunshine Photo CartUnauthenticated PHP Object Injection via 'key' Parameter
- 9.8Booster for WooCommerce
- 9.8Dynamic User Directory
- 9.8Payever - WooCommerce Gateway
- 9.8AFFI – Affiliate Marketing for WooCommerce
Show 22 more
- 9.8Balance
- 9.8Veto
- 9.8The Events Calendar
- 9.8GDPR Framework By Data443
- 9.8Advanced Post Manager
- 8.8Slider by 10Web
- 8.8LifterLMSAuthenticated (Custom+) PHP Object Injection via 'custom' Lesson Data
- 8.8Unlimited Elements For Elementor
- 8.8VK Google Job Posting Manager
- 8.8Simple Event Planner
- 8.1Gravity Forms
- 7.2WooCommerce Multilingual & Multicurrency
- 7.2Super Video Player
- 7.2Tainacan
- 7.2YITH WooCommerce Affiliates
- 7.2Online Scheduling and Appointment Booking SystemAuthenticated (Custom+) PHP Object Injection via 'value' Parameter
- 7.2Product Configurator for WooCommerce
- 7.2Pay with Vipps for WooCommerce
- 7.2WP Spell Check
- 7.2WP Ultimate Exporter
- 7.2Sunshine Photo Cart
- 7.2Product Feed PRO for WooCommerce
Authentication bypass in WordPress plugins
14 vulnerabilities
- 9.8WPCOM MemberUnauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback
- 9.8Advanced IP BlockerUnauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler
- 8.8PilotPressAuthenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter
- 8.8Simple JWT Login
- 8.1Easy Digital DownloadsUnauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture
Show 9 more
- 8.1SurecartUnauthenticated Account Takeover
- 8.1Vulnity SecurityUnauthenticated Authentication Bypass to Administrator via Exposed Pairing Credentials
- 8.1miniOrange OTP Login, Verification and SMS NotificationsUnauthenticated Authentication Bypass via Delay OTP Grace State
- 8.1Wpo365 LoginUnauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification
- 8.1Advanced Form IntegrationUnauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile…
- 7.5Graphina
- 7.3eRoom
- 7.1Grocery Shopping Store
- 5.3Advanced Google reCAPTCHA
Arbitrary file access in WordPress plugins
13 vulnerabilities
- 9.8rtMedia for WordPress, BuddyPress and bbPress
- 9.1BuddyPress XProfile Image FieldUnauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler
- 9.1PPOMUnauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter
- 8.6Simple File List
- 8.1FluentCart A New Era of eCommerceAuthenticated (Custom+) Arbitrary File Deletion via 'file_path' Parameter
Show 8 more
- 7.7PeepSo
- 7.7Jobs for WordPress
- 7.5rtMedia for WordPress, BuddyPress and bbPressMissing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Sideload via 'files[tmp_name]' Parameter
- 7.5PDF for Contact Form 7
- 7.5Generate PDF using Contact Form 7
- 6.8Presto Player Pro
- 6.5SiteOrigin Widgets BundleAuthenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable)
- 6.5Piotnet Addons For Elementor
Xen
8 vulnerabilities · Servers and applications
Oracle WebLogic Server
5 vulnerabilities · Servers and applications
- 9.8Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0,…
- 9.8Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0,…
- 9.1Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0,…
- 7.3Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0,…
- 5.9Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected…
Mangboard
4 vulnerabilities · WordPress plugins
- 9.8Unauthenticated Arbitrary File Upload via 'image_path' Parameter
- 7.2Unauthenticated Stored Cross-Site Scripting via 'content' Parameter via content_reply AJAX
- 7.2Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter
- 6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter
File inclusion in WordPress plugins
2 vulnerabilities
- 9.8DirectoryPress
- 8.1Werkstatt
Authentication bypass in servers and applications
5 vulnerabilities
- 9.6Fortinet FortiSandboxAn authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9,…
- 9.2LaravelToken-based API guard Auth Bypass
- 9.1MikroTik RouterOSMikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass
- 8.7MikroTik RouterOSMikroTik RouterOS WinBox split-principal authentication bypass allows privilege escalation
- 8.1SentryImproper email matching in SAML SSO process allows account takeover
WatchGuard Fireware OS
17 vulnerabilities · Servers and applications · most fixed in 12.5.22, 12.12.4, 2026.4
- 9.5Fireware OS Stack Buffer Overflow in WireGuard Configuration Allows Remote Code Execution
- 9.2Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution
- 9.2Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution
- 9.2Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code Execution
- 9.2Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection
Show 12 more
- 9.2Fireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds Write
- 9.1Fireware OS Stack Buffer Overflow in Logging Service Allows Remote Code Execution
- 8.7Fireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation
- 8.7Fireware OS XPath Injection in SSH Authentication Allows Blind Extraction of Configuration Secrets
- 8.7Fireware OS NULL Pointer Dereference in Management Interface Allows Unauthenticated Denial of Service
- 8.6Fireware OS Authenticated Stack Buffer Overflow in certd Allows Denial of Service
- 7.2Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root
- 7.2Fireware OS Out-of-Bounds Read in FireCluster Sync Allows Denial of Service
- 7.1Fireware OS Link Following in firewalld Allows Local Arbitrary File Overwrite as Root
- 6.1Fireware OS Stack Buffer Overflow in VPN Network Access Enforcement Allows Unprivileged Code Execution
- 6.0Fireware OS Missing Authentication in FireCluster State Sync Allows BOVPN Tunnel Denial of Service
- 5.6Fireware OS Improper Authentication in AuthPoint MFA Verification Allows Session Hijacking
YesWiki
35 vulnerabilities · Servers and applications · most fixed in 4.7.0
- 9.4Unauthenticated SQL injection through attacker-controlled Bazar field names in public entry-listing APIs
- 9.1Unauthenticated SQL injection in YesWiki Bazar entries search API via unescaped backtick in query field name
- 8.8YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create
- 8.8YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API
- 8.3YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox
Show 30 more
- 8.2YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile
- 8.2YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import
- 8.2SQL injection in PageManager::save via unescaped date_maj_fiche (forcedDate) in Bazar entry create
- 8.1Missing authorization in ActivityPub sync handler allows cross-actor entry manipulation via malicious outbox
- 8.1YesWiki admin despam action deletes and restores wiki pages via cross-site request forgery
- 7.2YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts
- 7.2YesWiki before 4.7.0 CSRF via despam Admin Action
- 7.1YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames
- HighStored XSS via `filtertags` action parameters (bypasses raw-HTML protection)
- HighImageField SVG upload stored XSS (incomplete fix for GHSA-67v5-7pfv-pp9m)
- 6.9YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand
- 6.9YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter
- 6.9YesWiki from 4.6.0 before 4.7.0 SQL Query Disclosure via showreq Parameter
- 6.9YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax
- 6.8Authenticated SSRF via unprotected downloadFile in page duplication API
- 6.8Authenticated SSRF via unprotected copyUrlToLocalFile in Bazar CSV import
- 6.5YesWiki Bazar read-ACL bypass via unescaped SQL LIKE wildcards in self-registered usernames
- 6.5Missing HTTP Signature replay protection allows indefinite re-execution of captured ActivityPub requests
- 6.4Stored XSS in YesWiki comment bodies via wakka raw-HTML syntax rendered through Twig raw filter
- 6.1Reflected XSS via BazarField $_REQUEST fallback through Twig |raw templates
- 6.1Stored XSS via unescaped Referer hostname in referrers_sites handler
- 5.3YesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallback
- 5.3YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler
- 5.3YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax
- 5.3YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters
- 5.3YesWiki Bazar showreq debug parameter discloses full SQL query to unauthenticated users
- 5.3YesWiki BazarListeAction unauthenticated within-namespace template traversal via GET parameter
- 5.3Unauthenticated Server-Side Request Forgery with response read-back via the [[|URL]] raw-inclusion syntax
- 5.1YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload
- 4.9SQL injection in the despam action via an unquoted INTERVAL operand
Froxlor
11 vulnerabilities · Servers and applications · most fixed in 2.3.15
- 9.4Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron
- 8.7Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value
- 8.6Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php
- 8.4Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members
- 5.3Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API
Show 6 more
- 5.3Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API
- 5.3Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API
- 5.3Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API
- 5.3Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API
- 5.3Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php
- 4.3Froxlor customer Traffic listing API bypasses the customer_hide_options traffic restriction
Portainer
9 vulnerabilities · Servers and applications
- 9.4Non-administrator inherits host bind mounts via Compose volumes_from in stack deployment
- 9.4Non-admin bind-mount restriction bypass via Docker local-driver volumes and automatic Git redeploy (incomplete fix of CVE-2026-44849 and CVE-2026-44850)
- 9.4Arbitrary host file read by standard user via Compose configs/secrets
- 7.1Denied Kubernetes namespace deletion causes unauthorized deletion of Portainer access policies and stack records
- 6.5Kubernetes shell query parameter confusion allows command execution in any Pod on Agent-managed environments
Show 4 more
- 5.8Cross-environment Kubernetes access via missing shell authorization and leftover service accounts
- 5.3Team Access Escalation via AuthorizedResourceControlUpdate Logic Flaw
- 5.3Team-leader GET /team_memberships returns all org memberships (IDOR)
- 5.3Server-Side Request Forgery across multiple outbound-request features
Chamilo LMS
8 vulnerabilities · Servers and applications
- 9.4Broken authorization in custom API controllers: cross-course document overwrite (stored XSS), unauthenticated video-conference meeting hijack, and…
- 8.1Improper authorization (IDOR / missing access control) cluster in AttendanceController and StudentPublicationController — any authenticated user can forge…
- 6.9Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization in AJAX Handlers
- 6.9Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookController
- 6.5Systemic IDOR across CourseBundle API resources and the Dropbox controller: any authenticated user can read any course's content, files, and rosters (<3.0.0)
Show 3 more
- 6.5Authenticated IDOR in Resource collection endpoints (/api/documents, /api/resource_nodes, /api/resource_files) leaks document and file metadata of every…
- 5.3Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGrade
- 5.1Chamilo LMS Ticket TicketManager.php addProject cross site scripting
Veeam Backup & Replication
6 vulnerabilities · Servers and applications · most fixed in 13.0.3, 13.1.2
- 9.4This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.
- 9.1A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.
- 8.3This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host.
- 6.1This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials.
- 5.9A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write…
- 5.9A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write…
SQL injection in WordPress plugins
63 vulnerabilities
- 9.3Green Popups
- 9.3uListing
- 9.3Elex Bulk Edit Products Prices Attributes For Woocommerce Basic
- 9.3Tickera
- 9.3Traveler
Show 58 more
- 9.3EduAdmin Booking
- 9.3Ajax Search Pro
- 9.3JNews - Pay Writer
- 9.3tagDiv Opt-In Builder
- 9.3WPLMS
- 9.3WP Data Access
- 9.3ARMember Premium
- 9.3Porto
- 9.3Newsletter Subscription Form
- 9.3SendPress Newsletters
- 9.3Gmedia Photo Gallery
- 9.3Radius Booking
- 9.3WP BASE Booking
- 8.5Barcode Scanner with Inventory & Order Manager
- 8.5Qode Tours
- 8.5Events Manager
- 8.5ProfileGrid
- 8.5Taskbuilder
- 8.5tagDiv Opt-In Builder
- 8.5WPLMS
- 8.5UpSolution Core
- 8.5Paid Member Subscriptions
- 8.5UDesign Core
- 8.5ListingPro
- 8.5Buddyboss Platform
- 8.5WP2LEADS
- 8.5WP BASE Booking
- 8.5Sirv
- 8.0BackuplyAuthenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation
- 7.6Link Whisper Free
- 7.6WOLF
- 7.6WP Ultimate CSV Importer
- 7.6Frontend Admin by DynamiApps
- 7.6Leyka
- 7.6Vitepos
- 7.6WP Post Author
- 7.6Slider by 10Web
- 7.6Post title marquee scroll
- 7.6Pix por Piggly (para Woocommerce)
- 7.6Dynamic User Directory
- 7.6affiliate-toolkit
- 7.5ViteposUnauthenticated SQL Injection via 'src_by' Parameter
- 7.5Link LibraryUnauthenticated SQL Injection via 'link_url' Parameter
- 7.5Appointment BookingUnauthenticated SQL Injection via 'booking[service_id]' Parameter
- 7.5WooCommerce Lottery
- 7.2Advanced Shipment Tracking for WooCommerceAuthenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameter
- 7.1WP Post AuthorWordPress Post Author Authenticated SQLi
- 7.1Mooberry Book Manager
- 6.5ViteposAuthenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator
- 6.5Mail MintAuthenticated (Custom+) SQL Injection via 'filters' Parameter
- 6.5WP Directory KitAuthenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)
- 6.5WP Booking SystemAuthenticated (Subscriber+) SQL Injection via 'current_month' Parameter
- 5.3FireBoxAuthenticated (Author+) SQL Injection via FireBox Form Display Condition
- 4.9WPML Multilingual & Multicurrency for WooCommerceAuthenticated (Shop Manager+) SQL Injection via Exchange Rate Field
- 4.9WP Booking SystemAuthenticated (Administrator+) SQL Injection via 'orderby' Parameter
- 4.9Animated Number CountersAuthenticated (Editor+) SQL Injection via 'counterid' Parameter
- 4.9Smart Popup by SupsysticAuthenticated (Administrator+) SQL Injection via 'sidx' Parameter
- 4.9WP Post AuthorWordPress Post Author Authenticated SQLi
Craft CMS
41 vulnerabilities · Servers and applications
- 9.3Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations
- 8.7Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE
- 8.7Craft CMS 5.0.0 before 5.11.0 Verification Code Reuse via users/set-password
- 8.7Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Field Layout
- 8.7Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection
Show 36 more
- 8.7Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection
- 8.7Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable
- 8.7Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection
- 8.7Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every
- 8.7Authenticated RCE via render-components Entry Type overrides
- 7.1Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters
- HighAuthenticated SQL injection via "Element::findOne()" array criteria
- HighImage transform class guard with `class:null` and `__class` bypass can lead to RCE
- HighLow privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE
- HighControl panel only API response emulation replaces "securityKey" and reaches server RCE
- High"app/render-elements" return URL signing oracle leads to RCE
- HighSQL injection leading to privilege escalation
- HighControl panel only blind SQL injection through "getNext"/"getPrev" criteria
- HighControl panel only administrator privilege escalation through sandbox allowed "getOwners(criteria)"
- HighUnauthenticated SQL injection via GraphQL eager-load "select" criteria
- HighAuthenticated RCE via Twig group filter array-callable
- HighAuthenticated RCE: Twig sandbox "on/as" behavior injection via "Asset::getMimeType" transform
- HighAuthenticated RCE: Twig sandbox "on/as" behavior injection via uncleansed "getNext/getPrev/getOwners" criteria
- HighAuthenticated RCE via render-components Entry Type overrides
- 6.9Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument
- 6.0Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition
- Medium"charts/get-new-users-data" lacks a "viewUsers" check
- MediumUnauthenticated GraphQL cross-site disclosure via "localized" field bypasses schema Sites scope
- MediumAnonymous GraphQL clients can read out-of-scope section content
- MediumPublic registration inherits direct permissions from a deactivated account
- MediumTwig sandbox allowlist bypass discloses sensitive values
- MediumVerification code survives verify-email use and remains valid for set-password
- MediumGraphQL site-scope enforcement missing on entry create, "deleteEntry" without "siteId", and Category/Tag/Asset delete mutations
- 2.1Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification
- LowIncomplete fix allows for "create()" blocklist in GHSA-j5wg-m2pr-35qc
- LowStored XSS in control panel license alert via cache poisoning
- LowStale sessions survive enabling 2FA and 2FA can be disabled without re-authentication
- Low"app/icon-svg" reads arbitrary SVG content files from any path or alias
- LowUnauthorized volume access through asset replacement
- LowAuthenticated admin RCE via Content Block field-layout JSON-string cleanse
- LowTwig "create()" blocklist case-sensitivity bypass
Grav
38 vulnerabilities · Servers and applications · most fixed in 2.2.18
- 9.3Page editor can call arbitrary static methods through a renamed field in a Flex form
- CriticalAnonymous visitors can read any server file through a public form upload
- 8.7Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives
- 8.7Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service
- 8.7Grav before 2.1.7 Information Disclosure via Nested .git Directories
Show 33 more
- 8.7Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy
- 8.7Page editor can read protected configuration through form config-*@ directives
- 7.1Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms
- 7.1Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox
- 7.0Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives
- HighMedia-only accounts and anonymous uploaders can inject Twig into pages through media metadata and file names
- HighPublishers can delete any server file through the image format option and take over the site
- HighPublishers can run shell commands through a Markdown image URL
- HighUser manager can grant super admin by hiding the access map under a YAML merge key
- HighUser manager can take over a super admin by disabling the super-admin group
- HighUser managers and Flex editors can overwrite, create or delete accounts through client-supplied storage keys
- HighPublishers and read-only user managers can read account password hashes, 2FA secrets and reset tokens
- HighPublishers can read account and configuration files through YAML parsing in Twig content
- HighPublishers can escape the Twig content sandbox through trusted embedded templates
- HighPublishers can read any server file by abusing allowed Twig sandbox calls
- HighAccounts with list access can delete Flex objects and take over the site
- HighPage-authored Flex form overrides let page editors run PHP and user managers become super admin
- HighPage editors can read secrets and run PHP through blueprint files
- HighAnonymous visitors can read pages protected in frontmatter.yaml after editors work through the API
- HighPublishers can run server code through a Host header that turns the pages folder into the configuration environment
- HighAnonymous visitors can inherit signed-in sessions from shared HTTP caches
- HighAnonymous visitor can create a super-admin account on installs whose path contains brackets
- HighAnonymous attackers can poison password-reset links through the CloudFront protocol header
- HighClockwork profiler data readable by unauthenticated visitors behind a same-host reverse proxy (Grav 1.7)
- HighPage editor can still call arbitrary static methods through a Flex form override
- HighLightbox Gallery: page editor can read server files into a public page through shortcode media actions
- HighPage author can delete protected pages through a Flex form opened by a page editor
- 6.9Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri
- MediumPage editors can overwrite pages their page permissions deny
- MediumUnauthenticated Host headers cause unbounded cache growth
- MediumMedia uploaders can store script-running SVG and XML files despite the upload sanitizer
- MediumPage authors can capture visitors' HTTP Basic credentials through Twig in page content
- MediumAnonymous visitors can bypass the image pixel limit when image URL actions are enabled
REDAXO
20 vulnerabilities · Servers and applications
- 9.3REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin
- 8.6REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation
- 7.7REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables
- 7.7Non-admin users with backup export permission can export authentication tables
- 7.1REDAXO before 5.21.4 Broken Access Control in Slice Operations
Show 15 more
- 7.1REDAXO before 5.21.4 Missing Authorization in Version and History Previews
- 7.1REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move
- 6.1REDAXO core before 5.21.5 Missing Authorization in rex_api_package API
- 6.1Package API does not check for admin permission
- 5.3Editors without the live version permission can change the live version of articles
- 5.1REDAXO before 5.21.3 CSRF in Article History Plugin
- 5.1REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool
- 5.1REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets
- 5.1REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter
- 5.1Missing CSRF protection on the safe mode toggle allows changing the global safe mode setting
- 2.3REDAXO before 5.21.5 Insufficient Session Expiration on Password Change
- 2.3Password change does not invalidate the current session and its stay-logged-in key
- 2.1REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter
- 2.1REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter
- 2.1REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads
Payload CMS
9 vulnerabilities · Servers and applications · most fixed in 3.90.0
ZITADEL
7 vulnerabilities · Servers and applications
- 9.3ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion
- 9.2ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie
- 8.8ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1
- 8.1Account Takeover via Header Injection
- 8.1One-Click Account Takeover through Device Code
Apache CouchDB
6 vulnerabilities · Servers and applications · most fixed in 3.5.3
- 9.3Apache CouchDB: Admin credentials leading to code execution as operating system user
- 8.1Apache CouchDB: Auth bypass in prefixed _users and _replicator databases
- 7.7Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session
- 6.0Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs
- 1.3Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values
- 0.6Apache CouchDB: Replicator follows redirects indefinitely
Path traversal in servers and applications
2 vulnerabilities
Snipe-IT
11 vulnerabilities · Servers and applications
- 9.2Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback
- 8.7Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition
- 8.2Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()
- 5.5Webhook testing endpoint allows port-scanning of internal services
- 5.3Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store
Show 6 more
- 5.1Snipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing Endpoint
- MediumGoogle SSO accepts deactivated users (activated flag not enforced on Google auth path)
- MediumLDAP StartTLS return value discarded, silent plaintext bind on downgrade
- MediumSAML assertion replay via non-atomic nonce check and missing UNIQUE constraint
- LowApi\AssetsController::store writes plaintext into encrypted-flagged custom-field columns when caller lacks assets.view.encrypted_custom_fields
- Lowcreated_by mass-assignment on Category, Company, License API endpoints (audit-trail spoofing)
Memory corruption in servers and applications
6 vulnerabilities
- 9.2EnvoyOut-of-Bounds Write in Brotli Decompressor
- 8.8ValkeyInteger truncation in Valkey cluster publish message construction causes a heap buffer overflow
- 7.5EnvoyUnauthenticated remote crash (null pointer dereference) in the OAuth2 HTTP filter via a path-less CONNECT request
- 7.2OpenVPNThe fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to…
- 7.1MikroTik RouterOSMikroTik RouterOS ipt_SAME.ko same_check integer overflow
- 2.1Fortinet FortiOSA Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.8, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0…
Parse Server
17 vulnerabilities · Servers and applications
- 9.1Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses
- 8.8Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB
- 8.3Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference
- 8.2Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Update
- 8.2Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error
Show 12 more
- 8.2Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL
- 6.9Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update
- 6.3Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key
- 6.3Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes
- 6.3Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries
- 6.3Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors
- 6.0Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions
- 5.3Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query
- 5.3Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query
- 2.3Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSession
- 2.3Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass
- 2.1Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login
Dolibarr ERP CRM
7 vulnerabilities · Servers and applications
- 9.1Remote Code Execution through incomplete sandbox in dol_eval_standard() (computed extrafields)
- 8.8SQL Injection in societe/class/societe.class.php via localtax1_value parameter
- 8.6Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter
- 7.5Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()
- 7.2Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field
Mastodon
4 vulnerabilities · Servers and applications
GLPI
23 vulnerabilities · Servers and applications · most fixed in 11.0.9
- 8.9Race condition in marketplace allowing malicious plugin installation
- 8.7Authorization bypass in massive actions
- 8.7Unauthenticated SQL injection in planning feature
- 8.6GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloning
- 8.62FA deactivation/modification on users with higher privileges
Show 18 more
- 8.6Privilege escalation via user cloning
- 8.6Reflected XSS in the dashboard search result widget
- 8.6MFA bypass via password reset
- 8.6XSS via form illustration import
- 8.5Stored XSS via asset name
- 8.5Stored XSS in ticket actors
- 8.5Stored XSS in network equipement models
- 8.4Arbitrary files deletion during documents creation
- 8.3Upload of malicious page on the web-server
- 7.7MFA bypass by another GLPI user
- 7.5Unexpected X509 authentication success with unverified certificated
- 7.1SQL Injection through form actors dropdown
- 7.0Improper rights checks in users deletion
- 6.9Users names enumaration via the planning feature
- 6.9Missing authorization checks in the planning feature
- 5.3GLPI through 12.0.0 Missing Authorization via ajax/map.php
- 5.3Unexpected access to followups/tasks/solutions generated from templates
- 5.3Unauthorized visibility expansion of knowbase items, reminders and RSS feeds
Grafana
12 vulnerabilities · Servers and applications
- 8.9SSO settings authorization bypass
- 7.7Azure Monitor access token disclosure via SSRF
- 7.7Alerting contact point authorization bypass via schema downgrade
- 7.1Viewer role can create, modify and delete Loki alerting rules
- 6.7Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
Show 7 more
- 6.5Server-side expression parser denial of service
- 6.5CVE-2026-16491 CVE Record
- 6.5Git Sync connection configuration can be modified with read-only access
- 6.5Unbounded memory allocation in the Prometheus rule conversion API
- 6.3Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs
- 6.0OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors
- 5.3Git Sync memory exhaustion via a malicious Git server
Broken access control in WordPress plugins
132 vulnerabilities
Show 127 more
- 7.5Modula Image GalleryMissing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT
- 7.5FunnelKitMissing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter
- 7.5Klarna for WooCommerceMissing Authorization to Unauthenticated Sensitive Information Disclosure via 'order-pay' Endpoint
- 7.5FluentCart A New Era of eCommerceInsecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters
- 7.5Bayarcash WooCommerce
- 7.5Print Invoices Packing Slip Labels For WoocommerceInsecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter
- 7.5Amelia
- 7.5Sermon'e
- 7.5Easy Digital Downloads
- 7.5WXD Backup Lite
- 7.5Advanced Posts Listing – Show Post List Easily
- 7.5WooCommerce Multivendor Marketplace – REST API
- 7.5PayPlug for WooCommerce (Official)
- 7.5WP Migration
- 7.5Fluent Affiliate Pro
- 7.5Morning for WooCommerce
- 7.5FluentBooking Pro
- 7.3Barcode Scanner with Inventory & Order Manager
- 7.3picu
- 7.3BEAR
- 7.2PowerPress Podcasting
- 7.1Th Shop Mania
- 7.1Wise Chat
- 7.1ECPay Ecommerce for WooCommerce
- 7.1WP2LEADS
- 6.9GIFT4U
- 6.9Cozy Blocks
- 6.9AI Chatbot for WordPress – Hyve Lite
- 6.8Photo Engine (Media Organizer & Lightroom)Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action
- 6.5WSP MCPAuthenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp_get_posts' MCP Tool
- 6.5Event post
- 6.5Jetpack VideoPress
- 6.5Sell Downloads
- 6.5Academy LMSMissing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target…
- 6.5Deposits and Partial Payments for WooCommerce
- 6.5ProfilePress
- 6.5Ultimate Post Kit
- 6.5HollerBox
- 6.5Delete All Comments of wordpress
- 6.510Web Social Photo Feed
- 6.5Autoship Cloud for WooCommerce Subscription Products
- 6.5Wappointment
- 6.5App for Cloudflare®
- 6.5WP Event Solution
- 6.5IATO MCP
- 6.5Faktur Pro for WooCommerce
- 6.5WC Ukraine Shipping
- 6.5Lookzy
- 6.5UsersWP
- 6.5Timetics
- 6.5Unlimited Elements For Elementor
- 6.5WP VR
- 6.3AWS S3 for WordPress
- 5.9ProfilePress
- 5.4FluentBoards
- 5.4WP-Members
- 5.4Booktics
- 5.4Event post
- 5.4TMDS
- 5.4VideoWhisper Site Manager for ChatGPT, Claude, Codex
- 5.4MicroPayments
- 5.4Fluent FormsMissing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification
- 5.4Hello PlusAuthenticated (Contributor+) Missing Authorization to Template Activation via hello_plus_set_as_entire_site
- 5.4Before After Image Comparison – Image comparison for WP
- 5.4WP Event Manager
- 5.4AI Translation for Polylang
- 5.4Starter Templates
- 5.4JS Help Desk
- 5.3ClickCease Click Fraud Protection
- 5.3AnyWhere Elementor
- 5.3Dokan
- 5.3Dokan
- 5.3WCFM Membership
- 5.3Uncanny Automator
- 5.3Better Search
- 5.3AI Alt Text GeneratorMissing Authorization to Unauthenticated Arbitrary Attachment Modification via 'post_id' Parameter
- 5.3JetFormBuilderMissing Authorization to Unauthenticated JetEngine Options Page Modification
- 5.3WP CompressMissing Authorization to Unauthenticated Account Linking / Site Takeover via 'force_ic_connect' and 'apikey' Parameters
- 5.3Site Reviews
- 5.3NotificationXMissing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route
- 5.3FOX
- 5.3Amelia
- 5.3WP User Manager
- 5.3Pay for Payment for WooCommerce
- 5.3Quick Paypal Payments
- 5.3Salevo
- 5.3Booktics
- 5.3Products Restricted Users for WooCommerce
- 5.3Cryptocurrency Payments Using Metamask For Woocommerce
- 5.3Envira Gallery LiteMissing Authorization via Gallery Conversion REST Endpoint
- 5.3Restrict User Access – Membership
- 5.3Scripts n Styles
- 5.3Creator LMS
- 5.3Visual Composer Website Builder
- 5.3YITH WooCommerce Product Bundles
- 5.3WP Rentals
- 5.3Zero Spam
- 5.3Captcha by BestWebSoft
- 5.3Woo Product Builder
- 5.3Kit (formerly ConvertKit) for WooCommerce
- 5.3WP Event Solution
- 5.3Fluent Forms Pro Add On Pack
- 5.3WP Mailster
- 5.3CURCY
- 5.0Paid Videochat Turnkey Site
- 4.8Login Lockdown
- 4.3myCred
- 4.3myCred
- 4.3WCFM Membership
- 4.3WP Map BlockMissing Authorization to Authenticated (Contributor+) Arbitrary Map Publish/Unpublish/Delete via set_status() and bulk() REST Endpoints
- 4.3Bulk Page GeneratorMissing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion via 'authorize' Parameter / Suite OAuth Flow
- 4.3Broadcast Live Video
- 4.3WP User Manager
- 4.3Flexible Subscriptions
- 4.3Woo Alidropship
- 4.3AutomatorWPMissing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via wp_ajax_automatorwp_fluentform_get_forms AJAX Action
- 4.3Appointment BookingInsecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via…
- 4.3Asgaros Forum
- 4.3VillaTheme Core
- 4.3Booktics
- 4.3Hustle
- 4.3WDS MCP Content Manager
- 4.3WP Dummy Content Generator
- 4.3WP Admin Audit
- 4.3JS Help Desk
- 3.1AI PufferMissing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification via ajax_save_semantic_search_settings AJAX action
- 3.1AI PufferMissing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification via ajax_save_cpt_indexing_options AJAX Endpoint
Jenkins
15 vulnerabilities · Servers and applications · most fixed in 2.580.2, 2.588
- 8.8Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their…
- 8.8Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can…
- 8.8Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with…
- 8.8Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent…
- 8.8Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during…
Show 10 more
- 8.1Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a…
- 8.1In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been…
- 8.1Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not…
- 6.5Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with…
- 6.1Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory,…
- 6.1Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller,…
- 5.4Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a…
- 5.4Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST…
- –Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and…
- –A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to obtain the server, port,…
Umbraco CMS
13 vulnerabilities · Servers and applications · most fixed in 17.7.2
- 8.8Back-office account takeover via sign-in redirect manipulation in Umbraco CMS
- 7.7Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning
- 6.5Backoffice users can grant user groups start nodes outside their own access (start node restriction bypass)
- 6.3Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs
- 5.4Stored XSS chained with path traversal in Umbraco CMS media management
Show 8 more
- 4.8Backoffice logout does not invalidate the auth cookie (session not ended server-side)
- 4.3Unpublished content exposed through website preview and the Delivery API
- 4.3Start-node restrictions not enforced on URL, imaging and reference lookups
- 4.3Backoffice users can read content outside their start node via the document version endpoints
- 4.3Authorization bypass allows low-privileged users to delete media outside their start node
- 3.7Website preview session did not expire
- 3.7Unauthenticated SignalR hubs disclose content identifiers and editorial activity
- 3.1Upload file extension restrictions are not enforced for file names ending in a period
Nginx UI
11 vulnerabilities · Servers and applications · most fixed in 2.9.0
- 8.8Config Directive Validation Bypass via Data File Extensions Allows Injection of Blocked Directives
- 8.8Nginx UI's restore endpoint accepts write-scoped service tokens and its interactive-admin denylist misses it, converting a service token into a persistent…
- 8.8PUT /api/cert_sync writes attacker-controlled content to any nginx conf-tree path, no validation, reloads without nginx -t
- 8.3Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context
- 8.1WebSocket short tokens still authenticate the HTTP MCP endpoint (incomplete fix of GHSA-gp79-j356-rr7m)
Show 6 more
- 7.7TestHealthCheck (POST /api/site_navigation/test_health_check/:id) is an auth-only SSRF primitive with a response-body substring oracle, invocable by…
- HighController node proxy bypasses secure-session step-up for cross-node administrative actions
- HighOTP secure-session step-up missing on system/restart, core-upgrade websocket, and upstream socket PUT (follow-up to GHSA-h246-wpgf-vmq5)
- 6.5Authenticated MCP request buffering lacked a body limit before v2.6.0
- 5.4Self-check fix endpoint rewrites live nginx.conf without interactive secure-session step-up
- 5.4Nginx log advanced-indexing toggle and destructive index rebuild lack interactive secure-session step-up
Silverstripe CMS
8 vulnerabilities · Servers and applications · most fixed in 6.2.13
Cross-site request forgery in WordPress plugins
6 vulnerabilities
Statamic
6 vulnerabilities · Servers and applications · most fixed in 5.74.5
- 8.8Path traversal in user email allows unauthenticated YAML file write and user record overwrite
- 8.3Arbitrary class instantiation via user-supplied validation rules in the Control Panel
- 6.5Glide signature bypass allows unsigned image manipulations
- 6.5Impersonation could be started when disabled via configuration
- 6.1Stored cross-site scripting via SVG assets that survive upload sanitization
- 3.5Server-Side Request Forgery via Glide (IPv6 address translation)
Groundhogg
5 vulnerabilities · WordPress plugins
Pimcore
5 vulnerabilities · Servers and applications · most fixed in 12.3.12
- 8.8SQL Injection via Unwhitelisted Filter Property in NotificationServiceFilterParser Allows Data Exfiltration
- 8.8SQL Injection via Unescaped FieldCollection fieldname in DataObject Listing JOIN Condition
- 8.0(Incomplete Patch) Unsafe PHP deserialization in lib/Tool/Authentication.php remains unpatched after CVE-2026-45162 fix
- 7.7Incomplete fix of Twig sandbox hardening (#19193 / GHSA-5qxq sibling): model getters reachable -> admin password-hash & recovery-token exfiltration and…
- 5.1Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview
Quiz And Survey Master
4 vulnerabilities · WordPress plugins
Privilege escalation in servers and applications
2 vulnerabilities
n8n
26 vulnerabilities · Servers and applications · most fixed in 2.41.4, 2.42.1
- 8.7n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables
- 8.4n8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy
- 8.2n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize Endpoint
- 7.7n8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log Operation
- 7.7n8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Workflow-Validation Interpreter
Show 21 more
- 7.2n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node Parameters
- 7.2n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview
- 7.2n8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-Workflows
- 7.1n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction
- 7.1n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node
- 7.1n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON
- 7.0n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter
- 7.0n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss Parameter
- 7.0n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook
- 7.0n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field
- 6.9n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger
- 6.9n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes
- 6.3n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution
- 6.1n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint
- 6.1n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval
- 6.0n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge
- 5.9n8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instance
- 5.3n8n before 1.123.85, 2.43.5, and 2.44.1 Chat Hub Authorization Bypass
- 5.1n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow
- 5.1n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance
- 5.1n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows
Zimbra Collaboration
17 vulnerabilities · Servers and applications
- 8.7Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation
- 8.7Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages Parameter
- 7.8Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration
- 7.8Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions
- 7.8Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection
Show 12 more
- 7.1Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation Right
- 6.5Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion
- 6.5Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable Expansion
- 6.5Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item Identifier
- 5.4Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters
- 5.3Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity
- 5.3Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response
- 5.3Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer
- 5.3Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution
- 4.3Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address
- 4.3Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization
- 3.7Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting
SvelteKit
12 vulnerabilities · Servers and applications · most fixed in 3.0.0
- 8.7`vite preview` path traversal vulnerability on Windows
- 7.5DoS while parsing form data from a remote functions `form`
- 7.5Build-time server-only module import guard could fail, resulting in server secrets being statically replaced in client bundle
- 6.9SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks
- 5.9Unhandled URIError when `reroute` rewrites a malformed pathname crashes adapter-node
Show 7 more
- 5.9Private `query.batch` functions could collide, producing unexpected parameter / function combinations
- 5.3Protocol-relative module import during server-side route resolution allows cross-origin script execution
- 5.3SSRF via redirects in server-side self-fetch fallbacks
- 2.3SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages
- 2.1SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions
- LowURL redirection to untrusted site via enhanced form submission
- LowXSS via untrusted cache-control header in prerendered page
Broken access control in servers and applications
10 vulnerabilities
- 8.7DokployDokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router
- 8.6Hestia Control PanelHestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation
- 8.3LangflowLangflow OSS Authorization Bypass Through User-Controlled Key
- 8.1SambaSamba: access control bypass via vfs_ceph_rgw case-insensitive open
- 6.9aaPanelaaPanel common.py GetClientIp access control
Show 5 more
- 6.5LivewireAuthorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order
- 5.3NextcloudApp passwords were allowed to bypass password confirmation on sensitive endpoints.
- 5.3DokployDokploy through 0.30.8 Cross-Organization Authorization Bypass via port tRPC Router
- 5.3LiteLLMBerriAI LiteLLM Secret Resolution main.py get_secret improper authorization
- 5.3StrapiStrapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions
AVideo
9 vulnerabilities · Servers and applications
- 8.7Stored XSS: an embed video's `videoLink` reaches an iframe src with its scheme unchecked
- 7.0WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.php
- 5.4XSS: the LiveLinks dynamic link carries an unvalidated URL into liveVideo.php HTML
- 5.4Stored XSS in AVideo comment Markdown block HTML rendering
- 5.3Race Condition in PayPal IPN Deduplication Enables Duplicate Wallet Credits
Show 4 more
- 5.3WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL Redirect
- 5.1WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering
- 5.1WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints
- 3.5CSRF on legacy playlist/video endpoints whose filenames don't match the `.json.php` auto-guard pattern
Denial of service in servers and applications
6 vulnerabilities
- 8.7rsyncrsync through 3.5.1 Denial of Service via hash_search() Checksum Collisions
- 8.2Expatlibexpat 2.7.2 through 2.9.0 Denial of Service via XML_ParserReset
- 7.5HAProxyHAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING…
- 7.5HAProxyHAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked…
- 7.1OpenVPNAn integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or…
- 6.7Fortinet FortiOSA improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the…
IBM WebSphere Application Server
5 vulnerabilities · Servers and applications
- 8.7IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic step
- 8.1IBM WebSphere Application Server is affected by a bypass authentication
- 8.0IBM WebSphere Application Server is affected by an authorization bypass
- 7.5IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a deserialization of untrusted data
- 7.5IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service
Sonatype Nexus Repository
4 vulnerabilities · Servers and applications · most fixed in 3.97.0
Uptime Kuma
4 vulnerabilities · Servers and applications
pfSense
20 vulnerabilities · Servers and applications
- 8.6Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install()
- 8.6Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync
- 8.6Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php
- 8.6Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner
- 8.6Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid
Show 15 more
- 8.6Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID
- 8.6Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters
- 8.6Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP
- 8.6Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php
- 8.6Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface
- 7.7Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh
- 7.5Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting
- 7.5Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection
- 7.5Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username
- 6.9Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL
- 5.1Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php
- 5.1Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php
- 4.8Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color
- 2.3Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php
- 2.3Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh
Harbor
15 vulnerabilities · Servers and applications · most fixed in 2.13.6, 2.14.5, 2.15.3
- 8.5SSRF in webhook delivery allows ProjectAdmin to reach internal services and cloud metadata endpoints
- 8.3Path traversal vulnerability in distribution endpoints
- 7.5Unauthenticated PUT request to /api/v2.0/users crashes Harbor core
- 7.5External auth-proxy identity named admin inherits Registry system-administrator authorization
- 7.2A system robot with user:update makes itself a system administrator
Show 10 more
- 7.2Robot "cover all projects" scope collapses into a global wildcard, conferring the deliberately-ungrantable robot:update — enabling cross-project robot…
- 5.4Registry chunk upload reuses unvalidated Location headers
- 4.3Webhook error responses can cause unbounded decompression in Jobservice
- 4.3scanner_registration.access_cred is missing filter:"false", giving a project admin a blind oracle over the scanner credential
- 4.3Immutable tag rule matcher only evaluates first repository/tag selector, allowing multi-selector rules to be bypassed
- 4.3Vulnerability & Content-Trust pull policies bypassable via attacker-controlled `User-Agent` header
- 4.2Scanner bearer authorization request disables TLS verification and reads the full response body
- 4.0SSRF and credential disclosure via attacker-controlled pagination Link header in the registry replication client
- –SSRF in Harbor webhook delivery allows ProjectAdmin to reach internal services
- 3.7Security middleware continues after AuthMode lookup failure
MySQL
49 vulnerabilities · Servers and applications
- 8.3Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are MySQL Server:…
- 7.5Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL…
- 7.5Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are MySQL…
- 7.5Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server:…
- 7.2Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL…
Show 44 more
- 6.8Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are…
- 6.7Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are…
- 6.5Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are MySQL Server:…
- 6.5Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: XML). Supported versions that are affected are MySQL Server:…
- 6.5Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are…
- 6.5Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: XML). Supported versions that are affected are MySQL Server:…
- 6.5Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL…
- 6.5Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are MySQL…
- 6.5Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: C API). Supported versions that are affected are MySQL Server:…
- 6.5Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: C API). Supported versions that are affected are MySQL Server:…
- 6.5Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL…
- 6.5Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are MySQL Server:…
- 6.5Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL…
- 5.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are…
- 5.5Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server:…
- 5.3Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are…
- 4.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL…
- 4.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL…
- 4.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL…
- 4.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL…
- 4.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL…
- 4.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL…
- 4.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL…
- 4.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server:…
- 4.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are…
- 4.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server:…
- 4.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL…
- 4.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server:…
- 4.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server:…
- 4.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server:…
- 4.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server:…
- 4.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server:…
- 4.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server:…
- 4.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are MySQL Server:…
- 4.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server:…
- 4.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL…
- 4.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL…
- 4.4Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL…
- 4.4Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server:…
- 4.4Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server:…
- 4.4Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server:…
- 4.4Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server:…
- 4.3Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are…
- 4.0Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server:…
ImageMagick
108 vulnerabilities · Servers and applications
- 8.2ImageMagick before 7.1.2-30 Use-After-Free in RSVG Decoder Without Cairo
- 8.2ImageMagick before 7.1.2-31 Invalid Memory Free in MVG Decoder
- 8.1Stack Buffer Over-Write when reading bzip2 compressed images
- 7.3ImageMagick through 7.1.2-33 and 6.9.13-58 Uncontrolled Search Path via Ghostscript Delegate
- 7.2ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Buffer Overflow via bzip2 Compressed Images
Show 103 more
- 6.9ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via Crafted XMP Profile
- 6.9ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via XML Parsing Depth Limit
- 6.9ImageMagick before 7.1.2-33 Memory Leak in MAT Decoder Error Path
- 6.9ImageMagick before 7.1.2-33 Policy Bypass in UHDR Decoder
- 6.9ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Temporary File Leak in JNG Decoder
- 6.9ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in PostScript Decoder
- 6.9ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure via JPEG Decoder
- 6.9ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MSL Decoder
- 6.9ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 XML Injection via CIP Encoder
- 6.9ImageMagick 7.1.1-7 before 7.1.2-32 Heap Buffer Over-Read via XMP Profile
- 6.9ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in SVG Encoder
- 6.9ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in TGA Decoder
- 6.9ImageMagick before 7.1.2-30 Stack Overflow in CALS Decoder
- 6.9ImageMagick before 7.1.2-30 Denial of Service via Crafted XMP Profile
- 6.9ImageMagick before 7.1.2-30 Security Policy Bypass via MAT Decoder
- 6.9ImageMagick before 7.1.2-31 Denial of Service via XMP Profile Parsing
- 6.9ImageMagick before 7.1.2-31 Security Policy Bypass via Coder Domain
- 6.9ImageMagick before 7.1.2-31 Unclosed File Pointer via Magick Script
- 6.9ImageMagick before 7.1.2-31 Denial of Service via MVG Decoder
- 6.7Code Injection in MAGICK, XBM, XPM and UIL encoder could result in injecting additonal headers or code
- 6.5Infinite Loop in SVG decoder
- 6.3ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in JNG Encoder
- 6.3ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Null Pointer Dereference in DJVU Decoder
- 6.3ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoder
- 6.3ImageMagick before 7.1.2-33 and 6.9.13-58 Heap Buffer Underwrite in PICT Decoder
- 6.3ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in Wavelet-Denoise Operation
- 6.3ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Code Injection via MVG Decoder
- 6.3ImageMagick 7.1.2-30 before 7.1.2-32 Use After Free in WBINFO Decoder
- 6.3ImageMagick 7.1.1-31 before 7.1.2-32 Null Pointer Dereference in PostScript Decoder
- 6.3ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Use After Free in PDF Writer via JPEG2000
- 6.3ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MVG Decoder
- 6.3ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in YUV Encoder
- 6.3ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in GIF Encoder
- 6.3ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in PNG Encoder
- 6.0ImageMagick before 7.1.2-31 Code Injection via PostScript Coders
- 6.0ImageMagick before 7.1.2-31 Heap Buffer Overflow in Distributed Pixel Cache Server
- 5.9ImageMagick before 7.1.2-31 Heap Buffer Overflow via GetVirtualPixels API
- 5.3Denial of service in BGR, CMYK, GRAY, RGB, YCBCR and YUV decoders
- 5.3Policy Bypass in various encoders when reading profiles
- 5.3Policy Bypass in ASE decoder
- 5.3Policy Bypass when reading XMP profile
- 5.3Policy Bypass in UHDR decoder because the extent checks happens to late
- 5.3Memory Leak in MAT decoder in an error path
- 5.3Memory Leak when hitting depth limit while parsing xml
- 5.3Memory leak when parsing crafted XMP profile
- 4.8ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Heap Buffer Overflow via X11 Animate
- 4.8ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -cdl Option
- 4.8ImageMagick before 7.1.2-33 Memory Leak in PerlMagick Property Reading
- 4.8ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -set profile Option
- 4.8ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Code Injection via MVG Encoder Drawing Options
- 4.8ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Overflow via MVG Decoder
- 4.8ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass in PS, PDF and XPS Decoders
- 4.8ImageMagick before 7.1.2-33 Heap Buffer Over-Read via Minimum-Bounding-Box
- 4.8ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass via Delegate Invocation Parsing
- 4.8ImageMagick 7.1.0-21 before 7.1.2-32 Heap Buffer Over-Read via -fx Option
- 4.8ImageMagick before 7.1.2-32 Policy Bypass via -script Operation
- 4.8ImageMagick before 7.1.2-32 Memory Leak via -process Option
- 4.4Policy Bypass on Windows when matching a path
- 4.4Heap Buffer Over-Read in the TIFF decoder that can result in a Heap Buffer Over-Write
- 3.9Policy Bypass due to an incomplete fix of GHSA-jjp4-3fwf-393j
- 3.7Information Disclosure in MNG decoder
- 3.7Information Disclosure in RLA decoder
- 3.7Use After Free in MSL decoder
- 3.7Use After Free in EXR decoder when memory allocation fails
- 3.7Stack Overflow in TIFF decoder when DNG decoder is disabled
- 3.7Memory Leak in MSL decoder
- 3.7Null Pointer Dereference in DJVU decoder
- 3.7Heap Buffer Over-Write in PICT decoder on 32-bit systems
- 3.7Memory Leak in JNG encoder
- 3.6Policy Bypass in with a symlink via IsRightsAuthorizedByName
- 3.6Code Injection in MVG encoder when specifying drawing options
- 3.5Data Tampering in Distributed Pixel Cache via pixel data modification
- 3.3Stack Overflow in MSVG decoder
- 3.3Heap Buffer Over-Read in -copy operation
- 3.3Policy Bypass when decoding MPC files
- 3.3Heap Buffer Over-Read in MVG decoder
- 3.3Null Pointer Dereference in `-subimage` when the image list has only one image
- 3.3Heap Buffer Over-Read when importing BGRO data
- 3.3Heap Buffer Over-Write when using the -morph option
- 3.3Policy Bypass possible through a delegate when an executable is blocked in the policy
- 3.3Heap Buffer Over-Read when specifying a minimum-bounding-box
- 3.3Policy Bypass of list length in the PS, PDF and XPS decoders
- 3.3Stack Overflow in MVG decoder
- 3.3Memory leak in -set profile option
- 3.3Memory leak in PerlMagick when reading properties
- 3.3Memory leak in CDL option
- 3.3Heap Buffer Over-Write when using X11 animate with crafted image
- 3.1Memory Leak in FPX encoder
- 2.5Heap Buffer Over-Write in stream operation
- 2.5Invalid Memory Free when using the DPC compare metric
- 2.5Heap Buffer Over-Write when requesting convex-hull information on 32-bit systems
- 2.5Memory Leak in compare when an operation fails
- 2.3ImageMagick before 7.1.2-33 Memory Leak in FPX Encoder
- 2.1ImageMagick before 7.1.2-31 Policy Bypass in CUT Encoder
- 2.0ImageMagick before 7.1.2-33 Memory Leak in magick compare
- 2.0ImageMagick before 7.1.2-33 Heap Buffer Overflow via Convex-Hull on 32-bit
- 2.0ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Undefined Behavior in INFO, JSON and YAML Encoders
- 2.0ImageMagick 7.1.0-20 before 7.1.2-32 Use After Free via -fx Option
- 2.0ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Heap Buffer Overflow via Concurrent Security Policy Access
- 2.0ImageMagick before 7.1.2-32 TOCTOU Symlink Race Path Policy Bypass via magick script
- 2.0ImageMagick 7.1.0-20 before 7.1.2-32 Invalid Memory Free in FX Operation
- 2.0ImageMagick before 7.1.2-33 Policy Bypass via Symlink in IsRightsAuthorizedByName
- 1.8ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 Security Policy Bypass via Incomplete Fix
Traefik
15 vulnerabilities · Servers and applications · most fixed in 3.7.14
- 8.2Data race on the shared bufio.Reader after an HTTP/1 upgrade in FastProxy panics the whole process
- 7.5Per-connection backend transport leak from unauthenticated Negotiate/NTLM headers (3.7.14+)
- 7.0ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clients
- 7.0ingress-nginx provider: mTLS (auth-tls-secret) silently disabled for a host when another Ingress on the same host has no matching auth-tls annotation
- 7.0Ingress-NGINX provider: colliding auth-tls-secret names merge two client CAs into one TLS option, so a host is gated by another host's CA
Show 10 more
- 7.0Kubernetes Ingress NGINX provider: ssl-passthrough sibling HTTP router serves the auth-protected backend without auth
- 7.0Ingress-NGINX provider forwards forged Ssl-Client-* identity headers on its HTTP route
- 7.0FastProxy backend connection pool leaks connection-bound NTLM/Negotiate identity to unauthenticated clients
- 7.0Connection-scoped NTLM/Kerberos sticky round tripper is not keyed by service, applying one service TLS client config to another
- 7.0Preauthenticated Negotiate contaminates Traefik's globally shared backend connection pool
- 7.0snicheck skips the check when `req.TLS` is nil (HTTP/2 `:scheme http`)
- 6.9Negated Host matcher causes a TLS option conflict that disables client-certificate authentication on the excluded host
- 6.4Traefik: Kubernetes Ingress and Service annotations allow cross-namespace references to Middlewares, ServersTransports, and TLSOptions
- 6.3Unsynchronized write to the per-connection sticky round tripper shared by concurrent HTTP/2 streams
- 2.1Kubernetes Ingress NGINX provider: a TLS-option cache hit skips the cross-namespace authorization check, letting an Ingress use another namespace's CA secret
Forminator
11 vulnerabilities · WordPress plugins
- 8.2Privilege Escalation
- 7.5Arbitrary Content Deletion
- 7.5Payment Bypass
- 7.5Broken Access Control
- 7.1Cross Site Scripting (XSS)
Show 6 more
- 7.1Cross Site Request Forgery (CSRF)
- 6.5Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block
- 6.5Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags
- 5.3Broken Access Control
- 5.3Broken Access Control
- 4.3Content Injection
Sylius
7 vulnerabilities · Servers and applications · most fixed in 2.1.17, 2.2.12, 2.3.2
- 8.2Promotion and coupon Usage Limit Bypass via Race Condition
- 8.1Host header injection in the shop password reset e-mail link when the channel has no hostname
- 8.1Percent-encoded API path bypasses shop API ownership filters, exposing and modifying other customers' data
- 6.9Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint
- 6.5A disabled API stays reachable through a percent-encoded path
IBM WebSphere Liberty
6 vulnerabilities · Servers and applications
- 8.2IBM WebSphere Application Server Liberty is affected by an improper access control
- 6.5IBM WebSphere Application Server Liberty Information Disclosure
- 6.5IBM WebSphere Application Server Liberty Improper Certificate Validation
- 5.5IBM WebSphere Application Server Liberty Path Traversal
- 5.4IBM WebSphere Application Server Liberty Incorrect Authorization
- 4.3IBM WebSphere Application Server Liberty Integer Overflow
RabbitMQ
5 vulnerabilities · Servers and applications · most fixed in 4.1.17, 4.2.12, 4.3.7
- 8.2LDAP authentication failures allow unauthenticated log amplification
- 7.1Memory DoS via incomplete AMQP 0-9-1 messages
- 6.3AMQP message conversion can repeatedly disconnect AMQP 0-9-1 consumers
- 5.7HTML injection in management UI OAuth login warning
- 5.7SASL credentials are not redacted from `amqp10_client` crash dumps and `sys:get_status` output
File inclusion in WordPress themes
21 vulnerabilities
Vaultwarden
7 vulnerabilities · Servers and applications · most fixed in 1.37.4
- 8.1Revoked or unconfirmed organization member retains read and delete access to organization ciphers
- 6.8Loop-carried user_created flag in send_invite deletes a pre-existing user's account and entire vault when an invite e-mail fails
- 6.8vaultwarden: device-level 2FA "remember" tokens survive admin-initiated 2FA removal, allowing 2FA bypass for up to 30 days (residual gap in fix f1ff613)
- 6.5Unbounded client-declared attachment fileSize causes an out-of-bounds panic that permanently breaks vault sync for every user who can see the cipher
- 4.3Organization member can move personal items into an organization without collection access
GiveWP
6 vulnerabilities · WordPress plugins
BIND 9
4 vulnerabilities · Servers and applications
GeoDirectory
4 vulnerabilities · WordPress plugins
- 8.1Unauthenticated Local File Inclusion via 'design_type' Parameter
- 6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute
- 6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field
- 6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field
Mattermost
6 vulnerabilities · Servers and applications · most fixed in 11.7.11
- 8.0Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post
- 6.5Unbounded memory consumption during PDF text extraction
- 6.5Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames
- 6.5Insufficient length validation when parsing Zoom chat transcriptions
- 4.3Null condition in Playbooks import crashes the plugin
- 2.7Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator
HashiCorp Vault
4 vulnerabilities · Servers and applications · most fixed in 2.1.2
- 8.0Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots
- 7.2Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions
- 5.9Vault PKI ACME Issues Certificate With Unvalidated SANs
- 5.4Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution
containerd
5 vulnerabilities · Servers and applications · most fixed in 2.4.2
- 7.8containerd CRI plugin: Checkpoint restore bypasses destination security context
- Mediumcontainerd: daemon crash when pulling an image with a crafted Content-Length header
- Mediumcontainerd: daemon crash when processing an image manifest with a malformed digest
- Mediumcontainerd: host disk exhaustion when pulling an image with an unbounded layer stream
- Mediumcontainerd CRI plugin: mount and snapshot leak when container checkpoint restore fails
Microsoft SQL Server
7 vulnerabilities · Servers and applications · most fixed in 15.0.2200.2, 15.0.4500.2, 16.0.1210.3
Discourse
6 vulnerabilities · Servers and applications · most fixed in 2026.7.4, 2026.8.2, 2026.10.0-latest.1
- 7.7Close MCP private-message read-scope gaps
- 6.9Staff-initiated DoS via regular expressions
- 5.4Free Patreon members may gain access to All Patrons-restricted groups
- 5.1Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed
- 5.0Category chat reviewables visible to moderators without category access
- 3.5SSRF through disallowed ports in onebox fetches
OpenBao
16 vulnerabilities · Servers and applications
- 7.6ACL Bypass via Non-Canonical URL Access in OpenBao's AppRole, Cert Auth, LDAP, and RADIUS plugins
- 7.6OpenBao's Transit allows import of key material at arbitrary paths
- 7.5OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal
- 7.0OpenBao's OIDC provider issues client credentials access tokens to unauthenticated callers for public clients
- 6.3OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing
Show 11 more
- 5.3OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI
- 5.3OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation
- 4.6OpenBao SSH secrets engine allows wildcard '*' in host cert principals via identity templates
- 2.1OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs
- 2.1OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints
- 2.1OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration
- 2.1OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial
- 2.1OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass
- 2.1OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses
- 2.0OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs
- 2.0OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters
Java
50 vulnerabilities · Servers and applications
- 7.5Vulnerability in Oracle Java SE (component: Java plugin). Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf. Difficult to exploit…
- 7.0Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions…
- 6.8Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported…
- 6.5Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions…
- 6.5Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported…
Show 45 more
- 6.5Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported…
- 6.5Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions…
- 6.5Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported…
- 6.5Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported…
- 6.5Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported…
- 5.9Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions…
- 5.9Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle…
- 5.9Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions…
- 5.9Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JDBC). Supported versions…
- 5.9Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported…
- 5.9Vulnerability in Oracle Java SE (component: Compiler). The supported version that is affected is Oracle Java SE: 26.0.2. Difficult to exploit vulnerability…
- 5.4Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that…
- 5.4Vulnerability in Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf; Oracle GraalVM Enterprise…
- 5.3Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions…
- 5.3Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions…
- 5.3Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported…
- 5.3Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Lightweight HTTP Server).…
- 5.3Vulnerability in Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1,…
- 5.3Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Supported versions that are affected are…
- 5.3Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO).…
- 5.3Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1,…
- 5.3Vulnerability in Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1,…
- 5.3Vulnerability in Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1,…
- 5.3Vulnerability in Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and 27. Easily…
- 5.3Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions…
- 5.3Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAAS). Supported versions…
- 4.8Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1,…
- 4.8Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serviceability).…
- 4.8Vulnerability in Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1,…
- 4.8Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and 27. Difficult to…
- 4.7Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JDK tools). Supported…
- 4.7Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1,…
- 4.0Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported…
- 3.7Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions…
- 3.7Vulnerability in Oracle Java SE (component: Networking). The supported version that is affected is Oracle Java SE: 27. Difficult to exploit vulnerability…
- 3.7Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are…
- 3.7Vulnerability in Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and 27. Difficult to…
- 3.7Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported…
- 3.7Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions…
- 3.7Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported…
- 3.7Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 25.0.4.1 and 27. Difficult to exploit…
- 3.7Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions…
- 3.6Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serviceability).…
- 3.1Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that…
- 2.6Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT). Supported versions…
Sensitive data exposure in WordPress plugins
39 vulnerabilities
- 7.5Contact Form 7 – Dynamic Text Extension
- 7.5Web Plura Backup & Restore Manager
- 7.5SiteVault – Backup, Restore, Migration & Cloning
- 7.5Xserver Migrator
- 7.5Snapshotify – All-in-One Backup & Restore & Migrate
Show 34 more
- 7.5Norvis Backup
- 7.5Museder RestoreOne
- 7.5SafeSnap – Verified WordPress Backup & Restore
- 7.5Sitemovr
- 7.5Five Star Restaurant Reservations
- 7.2Edwiser Bridge
- 7.1RepairBuddy
- 6.9QA Analytics
- 6.9Motors
- 6.5AnyWhere Elementor
- 5.9WP Fastest CacheUnauthenticated Sensitive Information Exposure via Cached wp-activate.php Response
- 5.9Swish Migrate and Backup
- 5.9WP Rollback
- 5.3HUSKYUnauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Script
- 5.3Lightweight Cookie NoticeSensitive Information Exposure via W3TC_DYNAMIC_SECURITY Constant
- 5.3Active Products Tables for WooCommerce
- 5.3WPGraphQL
- 5.3YITH WooCommerce Product Add-Ons
- 5.3Booking CalendarUnauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action
- 5.3Online Scheduling and Appointment Booking SystemUnauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details
- 5.3Modula Image Gallery
- 5.3Mailjet Email Marketing
- 5.3WP Event Solution
- 5.3PowerPress Podcasting
- 5.3Video Conferencing with Zoom
- 5.3Events Manager
- 4.3Image HubAuthenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML
- 4.3Ad InserterAuthenticated (Subscriber+) Sensitive Information Disclosure in 'ai-debug-processing-fe' & 'ai-debug-meta' URL Parameters
- 4.3Download ManagerAuthenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension…
- 4.3All Bootstrap Blocks
- 4.3Polylang
- 4.3Memberful - Membership
- 3.7SpeedyCacheUnauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check
- 2.7WP Mail LoggingAuthenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email
c-ares
11 vulnerabilities · Servers and applications · most fixed in 1.34.9
- 7.5c-ares can corrupt memory when an application cancels its lookups after a connection failure
- 5.9c-ares can free a cached DNS answer while the application is still reading it
- 5.9c-ares can use a freed server record when an application changes its DNS servers from a callback
- 5.9c-ares can use freed memory when an application cancels lookups from a server-status callback
- 5.9c-ares can use freed memory if an application cancels lookups from a callback, or shuts a channel down
Show 6 more
- 5.9c-ares can use a freed lookup after shutting down a failed connection
- 5.9c-ares can accept a DNS reply that arrived from a different server than the one queried
- 5.5c-ares can use a freed connection after the socket-state callback returns
- 5.3c-ares can write past a buffer when ares_dup() or ares_save_options() runs while another thread changes the servers
- 4.8c-ares can return an address containing uninitialized memory for a numeric IPv6 name with a prefix length
- 3.7c-ares query cache can return an answer that was obtained using different EDNS options
Unbound
5 vulnerabilities · Servers and applications · most fixed in 1.26.2
- 7.5DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.
- 6.5Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent.
- 5.3Aggregate DNS name chained pointer decompression work leads to degradation of service.
- 5.3Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'
- 3.7Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record.
Broken access control in WordPress themes
4 vulnerabilities
- 7.5DK
- 7.5Grand News
- 7.5Motors
- 7.5The7
Elasticsearch
4 vulnerabilities · Servers and applications
- 7.5Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
- 6.5Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
- 4.3Incorrect Authorization in Elasticsearch Leading to Information Disclosure
- 4.2Use of Cache Containing Sensitive Information in Elasticsearch Leading to Information Disclosure
MLflow
4 vulnerabilities · Servers and applications · most fixed in 3.17.0
- 7.5Arbitrary file read on unauthenticated MLflow servers via prompt model version source
- 6.5SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
- 6.5MLflow CrewAI autologging records LLM provider API keys in logged trace spans
- 4.3Missing authorization on gateway secret creation in MLflow basic-auth with workspaces enabled
Path traversal in WordPress plugins
4 vulnerabilities
- 7.5Contact Form Extender for Divi BuilderUnauthenticated Arbitrary File Deletion via Path Traversal
- 6.5TainacanAuthenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter
- 4.9ListdomAuthenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'ix[file]' Parameter
- 4.9Post Export Import with MediaAuthenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_path' Parameter in media_metadata.json
Server-side request forgery in WordPress plugins
5 vulnerabilities
Wagtail
5 vulnerabilities · Servers and applications
- 7.3Stored XSS attack via v3 write API and third-party HTML editors
- 6.5Formula injection via XLSX export
- 6.5Cross-Collection authorization bypass via Collection privacy settings
- 4.3Improper restriction handling on Pages admin API for ancestor pages
- 4.3Improper restriction handling on API v3 (preview) pages endpoint
Kibana
4 vulnerabilities · Servers and applications
- 7.3Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Resource Deletion
- 6.5Insertion of Sensitive Information Into Sent Data in Kibana Leading to Credential Disclosure
- 4.3Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure
- 4.3Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure
Cross-site scripting in WordPress plugins
222 vulnerabilities
- 7.2SureCartUnauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment
- 7.2WPConsentUnauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS)
- 7.2TranslatePressUnauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers
- 7.2CP Multi View Events CalendarUnauthenticated Stored Cross-Site Scripting via 'CalendarTitle' Parameter
- 7.2User Profile BuilderUnauthenticated Stored Cross-Site Scripting via First Name Field
Show 217 more
- 7.2SiteOrigin CSSUnauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink
- 7.2NotificationXUnauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route
- 7.2SiteOrigin CSSUnauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector
- 7.2Salon Booking SystemUnauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX
- 7.2Opti-BehaviorUnauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter
- 7.2Simply Schedule AppointmentsUnauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}
- 7.2Opti-BehaviorUnauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter
- 7.2Schema & Structured Data for WP & AMPUnauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parameter
- 7.2Complianz GDPR/CCPA Cookie Consent BannerUnauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter
- 7.2Premium PackagesUnauthenticated Stored Cross-Site Scripting via 'order_email'
- 7.2Bit integrationsUnauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook Callback
- 7.2AcyMailingUnauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter
- 7.2WPAdvertsUnauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter
- 7.2Wpo365 LoginUnauthenticated Stored Cross-Site Scripting via 'id_token' Parameter (iss / unique_name JWT claims)
- 7.2FunnelKitUnauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)
- 7.2Molongui AuthorshipUnauthenticated Stored DOM-Based Cross-Site Scripting via Comment href Attribute
- 7.2WP Photo Album PlusUnauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History
- 7.2WP Meteor Website Speed Optimization AddonUnauthenticated Stored Cross-Site Scripting via Comment Author Name
- 7.210Web BoosterUnauthenticated Stored Cross-Site Scripting via Comment Author Name
- 7.2LazyLoadUnauthenticated Stored Cross-Site Scripting via Comment Content
- 7.2Photo Reviews for WooCommerceUnauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter
- 7.2VikBooking Hotel Booking Engine & PMSUnauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter
- 7.2Post Grid Gutenberg BlocksUnauthenticated Stored Cross-Site Scripting via display_name User Field
- 7.2Easy Digital DownloadsUnauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters
- 7.2Podlove Podcast PublisherUnauthenticated Stored Cross-Site Scripting via Auphonic Webhook
- 7.2Presto PlayerUnauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag
- 7.2Real Estate ManagerUnauthenticated Stored Cross-Site Scripting via 'first_name' Parameter
- 7.2OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed
- 7.2Kirki – Freeform Page Builder, Website Builder & CustomizerUnauthenticated Stored Cross-Site Scripting via Registration Metadata
- 7.2Post SMTPUnauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)
- 7.1Houzez
- 7.1JetEngine
- 7.1JetProductTables
- 7.1Barcode Scanner with Inventory & Order Manager
- 7.1Document Embedder
- 7.1Before After Image Comparison – Image comparison for WP
- 7.1Team Section Block
- 7.1Photo Gallery by 10Web
- 7.1Slider by 10Web
- 7.1Tlp Food Menu
- 7.1FV Player 8
- 7.1Social Share Icons & Social Share Buttons
- 7.1Qode Real Estate
- 7.1Qode Music
- 7.1Jotform – AI Chatbot
- 7.1Additional Order Filters for WooCommerce
- 7.1WP File Download
- 7.1ThemeStek Extras for LabtechCO
- 7.1WPAdverts
- 7.1WPAdverts
- 7.1AcyMailing SMTP Newsletter
- 7.1WP Associate Post R2
- 7.1Gloria Admin Panel
- 7.1Total Donations
- 7.1Grand Restaurant
- 7.1Kubio AI Page Builder
- 7.1Sassy Social Share
- 7.1Simple Payment
- 7.1NEX-Forms
- 7.1JetBlog
- 7.1Salon booking system
- 7.1Betheme
- 7.1BlockStrap Page Builder - Bootstrap Blocks
- 7.1UsersWP
- 7.1UpSolution Core
- 7.1Welcart e-Commerce
- 7.1Search in Place
- 7.1Media LIbrary Assistant
- 7.1VikBooking Hotel Booking Engine & PMS
- 7.1ShopBuilder – Elementor WooCommerce Builder Addons
- 7.1HUSKY
- 7.1FiboSearch
- 7.1aBlocks
- 7.1WPCompleteCSRF to Stored XSS vulnerability
- 7.1Disable and Remove Google Fonts | GDPR & DSGVO friendly
- 7.1Everest Forms
- 7.1Unlimited Elements For Elementor
- 7.1WP Mailster
- 7.1Form Block
- 7.1LearnPress
- 7.1picu
- 7.1Charitable
- 7.1Fluent Forms Pro Add On Pack
- 7.1WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
- 7.1WooCommerce Simple Auctions
- 7.1Social Rocket
- 7.1Video Background Block
- 7.1CF7 Views – Complete Entry Management for Contact Form 7
- 7.1Blog, Posts and Category Filter for Elementor
- 7.1VikRentCar
- 7.1Document Gallery
- 7.1Hotel Booking
- 7.1Youzify
- 7.1Ansar Import
- 7.1Security & Malware scan by CleanTalk
- 7.1ARForms
- 7.1Midtrans-WooCommerce
- 7.1Storegrowth Sales Booster
- 7.1Contact Form to DB by BestWebSoft
- 7.1Database for CF7
- 7.1Lumise Product Designer
- 7.1HTTP Requests Manager
- 7.1Mapster WP Maps
- 7.1Frontend File Manager
- 7.1Smart Forms
- 7.1SUMO Affiliates Pro
- 7.1WP User Frontend Pro
- 7.1Progressify - Progressive Web App (PWA)
- 7.1WP Media folder
- 7.1Payflex Payment Gateway
- 7.1Real 3D FlipBook
- 7.1Photo Reviews for WooCommerce
- 7.1Adsmonetizer
- 6.5AnyWhere Elementor
- 6.5Posts Table with Search & Sort
- 6.5Paid Member Subscriptions
- 6.5JetSmartFilters
- 6.5Books Gallery
- 6.5Prime Slider – Addons For Elementor
- 6.5PowerPack Addons for Elementor
- 6.5Premium Addons for Elementor
- 6.5SureForms
- 6.5Responsive Slider
- 6.5FV Simpler SEO
- 6.5IMPress for IDX Broker
- 6.5Weaver Xtreme
- 6.5Premium Addons for Elementor
- 6.5Element Pack Elementor Addons
- 6.5Ad Inserter
- 6.5JetMenu
- 6.5JetElements For Elementor
- 6.5Custom Query Blocks
- 6.5FV Flowplayer Video Player
- 6.5WPFunnels
- 6.5Html5 Audio Player
- 6.5Classified Listing
- 6.5JetReviews
- 6.5JetBlocks For Elementor
- 6.5Zotpress
- 6.5WP
- 6.5MasterStudy LMS
- 6.5Gutenberg Blocks by Kadence Blocks
- 6.5WP Store Locator
- 6.5Robo Gallery
- 6.5ShortPixel Image Optimizer
- 6.5Happy Addons for Elementor
- 6.5Prime Slider – Addons For Elementor
- 6.5Rocket Lazy Load
- 6.5Element Pack Elementor Addons
- 6.5Media LIbrary Assistant
- 6.5Element Pack Elementor Addons
- 6.5Front End PM
- 6.5WC Fields Factory
- 6.5Ohio Extra
- 6.5JetElements For Elementor
- 6.5RepairBuddy
- 6.5Image Slider Widget
- 6.5Starter Templates
- 6.5Name Directory
- 6.5Presto Player
- 6.5Premium Addons for Elementor
- 6.5Logo Showcase
- 6.5MP3 Audio Player for Music, Radio & Podcast by Sonaar
- 6.5eCommerce Product Catalog
- 6.5QR Redirector
- 6.5B Blocks
- 6.5Image Photo Gallery Final Tiles Grid
- 6.4Photo Engine (Media Organizer & Lightroom)Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection Name
- 6.4News Kit Addons For ElementorAuthenticated (Subscriber+) Stored Cross-Site Scripting via nekit_update_mega_menu_form AJAX Action
- 6.4SEO EngineAuthenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-then-Decode in build_title()
- 6.4Name DirectoryAuthenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode Attribute
- 6.4Social Share ButtonsAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network Setting
- 6.4SureDashAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
- 6.4FiboSearchAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter
- 6.4WebberZone Top 10Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes' Block Attribute
- 6.4Premium PackagesAuthenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes
- 6.4TourficAuthenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute
- 6.4User Profile BuilderAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
- 6.4SQL Chart BuilderAuthenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User Field
- 6.4Quick PayPal Payments: Payment Button & FormAuthenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode Attribute
- 6.4VK BlocksAuthenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' Feature
- 6.4KirkiAuthenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content
- 6.4PeproDev Ultimate Profile SolutionsAuthenticated (Contributor+) Stored Cross-Site Scripting via 'button' Attribute
- 6.4Premium PackagesAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter
- 6.4SureDashAuthenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content
- 6.4Email Marketing for WordPress and WooCommerceAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter to /updateOptions REST Endpoint
- 6.4MotorsAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter
- 6.4Simple MembershipAuthenticated (Subscriber+) Stored Cross-Site Scripting via Country Field
- 6.4TeamAuthenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_taxonomy' Post Meta via [tlpteam] Shortcode
- 6.4Frontend Admin by DynamiAppsAuthenticated (Contributor+) Stored Cross-Site Scripting via Post Content
- 6.4User FrontendAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter
- 6.4BrizyAuthenticated (Contributor+) Stored Cross-Site Scripting via 'brizy-compiled-sections' Post Meta
- 6.4Data Tables Generator by SupsysticAuthenticated (Contributor+) Stored Cross-Site Scripting via Table 'id' HTML Attribute
- 6.4Kadence BlocksAuthenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute
- 6.4Embed Any DocumentAuthenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcode
- 6.4GamiPressAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id' Parameter
- 6.4MP3 Audio PlayerAuthenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- 6.4RSS Aggregator by FeedzyAuthenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title>
- 6.4Download ManagerAuthenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute
- 6.4FV Flowplayer Video PlayerAuthenticated (Subscriber+) Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute
- 6.4Data Tables Generator by SupsysticAuthenticated (Subscriber+) Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action
- 6.4Table Field Add-on for ACF and SCFAuthenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value
- 6.4Advanced Classifieds & Directory ProAuthenticated (Custom+) Stored Cross-Site Scripting via 'phone' Parameter
- 6.1Gwolle GuestbookReflected Cross-Site Scripting via 'permalink' Parameter
- 6.1Tracking Code ManagerReflected Cross-Site Scripting via 'TCM_ErrorMessages'
- 6.1Payment Plugins for Stripe WooCommerceReflected DOM-Based Cross-Site Scripting via '#response' URL Fragment
- 6.1Download ManagerUnauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter
- 6.1Form Maker by 10WebReflected Cross-Site Scripting via 'inputs' Parameter Array Key
- 6.1Filter Everything — WordPress & WooCommerce FiltersReflected Cross-Site Scripting via Elementor Posts Widget Pagination URL
- 5.4Events Made EasyUnauthenticated Stored Cross-Site Scripting via 'event[location_name]' Parameter
- 5.4WPeMatico RSS Feed FetcherUnauthenticated Stored Cross-Site Scripting via RSS Feed Content Import
- 5.4Simple NewsletterUnauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot
- 5.4Anti-Spam by CleanTalkUnauthenticated Stored Cross-Site Scripting via Comment Content via ContactsEncoder Greedy Regex
- 5.1LearnpressLearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation
- 4.7JetFormBuilderReflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer
- 4.7Fluent FormsReflected Cross-Site Scripting via '{get.*}' Editor SmartCode Parameter
- 4.4Responsive Lightbox & GalleryAuthenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute
Roundcube
6 vulnerabilities · Servers and applications · most fixed in 1.6.20, 1.7.5
- 7.2Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by…
- 7.1Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF…
- 6.8Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs…
- 6.5Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an…
- 5.3Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation…
- 5.3Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file based…
HivePress
4 vulnerabilities · WordPress plugins
- 7.2Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value
- 7.2Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form
- 6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form Shortcode
- 6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format
Cross-site scripting in WordPress themes
20 vulnerabilities
- 7.1XStore
- 7.1Kids Planet
- 7.1Educavo
- 7.1LMS
- 7.1KuteShop
Show 15 more
- 7.1Biolife
- 7.1TechOne
- 7.1Armania
- 7.1Pin WP
- 7.1Ambed
- 7.1Martfury - WooCommerce Marketplace WordPress
- 7.1Zeinet
- 7.1Education Center
- 7.1Pond
- 7.1Treck
- 7.1Ogency
- 7.1Voldor
- 7.1Whistle - Sports Club
- 7.1EduMall
- 7.1WPLMS
Directus
5 vulnerabilities · Servers and applications
- 7.1Authenticated persistent Denial of Service via prototype pollution in CSV import
- 6.8IP-restricted policies bypassed via GraphQL WebSocket subscriptions
- 6.6File uploads can write into the extensions directory, leading to code execution in overlapping storage configurations
- 6.5Update and delete by query evaluate filters without read permissions, leaking hidden field values
- 3.1AI Chat route exposes admin-only tools to non-admin users
MongoDB
5 vulnerabilities · Servers and applications · most fixed in 8.0.34, 8.3.13, 9.0.4
- 7.1Incorrect authorization in MongoDB Server router for bulk writes to system namespaces
- 7.1Collection validators using collation-accepting expressions can crash MongoDB Server on insert
- 7.1Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service
- 6.0MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline
- 5.3Fixed values in MongoDB Server $bucket stage may be misread as field references
Tutor LMS
4 vulnerabilities · WordPress plugins
Next.js
7 vulnerabilities · Servers and applications
- 6.9SVG rejection bypass in Next.js image optimization
- 6.3Cross-client response injection and disclosure in self-hosted Next.js applications forwarding fetched responses
- 6.3Cross-user cache disclosure and poisoning in Next.js use cache with binary arguments
- 6.3Cache poisoning of shared fallback shells in Cache Components via request-supplied placeholder route params
- 6.3Cache leak across root param values in nested 'use cache' functions via delayed inner stream metadata
Zabbix
6 vulnerabilities · Servers and applications
Server-side request forgery in servers and applications
2 vulnerabilities
Hugo
5 vulnerabilities · Servers and applications · most fixed in 0.167.0
- 6.7Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor
- 6.7Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback
- 6.7Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver
- 5.1Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs
- MediumTheme-defined module.replacements bypass mount restrictions and widen the Node.js read sandbox
Palo Alto Networks PAN-OS
6 vulnerabilities · Servers and applications · most fixed in 11.1.16-h3, 11.2.16, 12.1.10-h2
- 6.6PAN-OS: Denial of Service (DoS) Vulnerabilities in Network Services
- 6.1PAN-OS: Authenticated Admin Command Injection Vulnerability
- 4.9PAN-OS: Improper Input Handling Vulnerability
- 4.6PAN-OS: Denial of Service (DoS) on Panorama
- 1.2PAN-OS: Denial of Service Vulnerability
- 1.1PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability
Nuxt
12 vulnerabilities · Servers and applications · most fixed in 4.6.4
- 6.5Incomplete fix for GHSA-9v7c-q64q-vv33: a leading `//` in the request path bypasses `server/middleware` path checks and server route rules on page routes
- 6.5Incomplete fix for GHSA-6gq8-jgmh-3ffp: an encoded slash (`%2F`) in the request path bypasses route rules on catch-all page routes
- 6.5Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes
- 6.3Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive
- 5.9Nuxt dev server serves files from a parent directory with a stray lockfile or workspace file
Show 7 more
- 5.4Nuxt server islands render `useHeadSafe` input without sanitisation
- 5.3Nuxt exposes the message and data of unhandled errors thrown during server rendering
- 3.1Colliding island props can share one `/__nuxt_island` path (incomplete fix for CVE-2026-46342)
- 3.1Nuxt Vite server builder wildcard `redirect` route rules can redirect to another origin
- 3.1@nuxt/webpack-builder and @nuxt/rspack-builder dev server serves built source to DNS rebinding pages
- 2.3Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled
- LowNuxt payload URL generation has quadratic cost for repeated slashes in the request path
User Registration
7 vulnerabilities · WordPress plugins
- 6.5Cross Site Scripting (XSS)
- 5.6Broken Access Control
- 5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name
- 5.4Broken Access Control
- 5.4Cross Site Request Forgery (CSRF)
Show 2 more
Cross-site scripting in servers and applications
2 vulnerabilities
October CMS
10 vulnerabilities · Servers and applications
- 5.5Media Library Crop Handler Bypasses Upload Extension Allowlist
- 5.4Stored XSS via Untrusted Client Filename Extension in Attachment Disk Name
- 3.8Role Reorder Authorization Bypass in UserRoles Controller
- 3.8OS Command Injection via Sendmail Path Mail Setting
- 3.5Stored XSS in Mail Template Preview via Unsandboxed Iframe
Event Tickets
4 vulnerabilities · WordPress plugins
Django
10 vulnerabilities · Servers and applications · most fixed in 5.2.19, 6.0.10, 6.1.3
- 5.3Server-side request forgery via SpatialReference string input
- 5.3Server-side request forgery via crs member of GeoJSON geometries
- 5.3Potential log injection via unescaped geometry form values
- 5.3Potential memory exhaustion in MultiPartParser via base64-encoded file upload
- 5.3Potential request forgery via spatial lookup byte values
Show 5 more
- 5.3Potential denial-of-service vulnerability in HTTP header parsing
- 5.3Potential denial-of-service vulnerability in get_supported_language_variant()
- 4.3Privilege abuse in model formsets with editable primary keys
- 3.1Potential exposure of private data via empty and missing Vary headers
- 2.2Password hash disclosure to "view only" admin users with custom user models
Apache Kafka
12 vulnerabilities · Servers and applications
- –Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches
- –Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs
- –Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint
- –Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions
- –Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation
Show 7 more
- –Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation
- –Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing
- –Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers
- –Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service
- –Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured
- –Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default
- –Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed…
Other vulnerabilities in servers and applications
41 vulnerabilities
- 10.0LiteLLMUnauthenticated file read leaks master key on Enterprise proxy
- 9.3Microsoft Exchange ServerMicrosoft Exchange Server Spoofing
- 8.7SymfonyUnbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process
- 8.7SymfonyUnbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process
- 8.7SymfonyReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header
Show 36 more
- 8.6CrushFTPCrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/
- 8.6Movable TypeAn SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL…
- 8.3Expatlibexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBuffer
- 8.2Eclipse JettyWhen Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client…
- 8.2Eclipse JettyIn Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpClient…
- 8.1Microsoft SharePoint Enterprise Server 2016Microsoft Office SharePoint Spoofing
- 8.1ShopwareCVE-2026-104937
- 7.8Backdrop CMSBackdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This…
- 7.6OpenVPNOpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field
- 7.5NextcloudAbusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there…
- 7.5Backdrop CMSBackdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name])…
- HighBunHTTP/3 QPACK amplification allows remote memory exhaustion and CPU stall
- HighBunBundled root certificates trust compromised eMudhra (emSign) intermediate CAs
- HighAngularXSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)
- 6.9CoolifyCoolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints
- 6.9MinIOMinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key
- 6.9Eclipse JettyIn Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the…
- 6.5LaravelUnauthorized Data Destruction
- 6.5GitLabAllocation of Resources Without Limits or Throttling in GitLab
- 6.5EnvoyCrash in api_key_auth HTTP filter when hiding credentials on requests without a :path header (CONNECT)
- 6.4OPNsenseCA/Cert PEM Imported Payload Allows OpenVPN Directive Injection Leading to Root OS Command Execution
- 6.3TYPO3TYPO3 CMS - Security Misconfiguration in Form Framework
- 5.9KubernetesStatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
- 5.8KubernetesSubpath symlinking on Windows nodes permits NTLM coercion
- 5.4OpenProjectImproper input validation in PDF hyphenation language allows local file load
- 5.3Backdrop CMSBackdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous…
- 5.3Kirbygetkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization
- 5.3LiteLLMBerriAI LiteLLM Spend Tracking spend_management_endpoints.py ui_view_session_spend_logs authorization
- 4.9Fortinet FortiSandboxA use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all…
- 4.8Fortinet FortiSandboxAn Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4…
- 4.3OpenProjectWork-package budget link discloses budget subject to users lacking view_budgets
- 4.3NextcloudWhen a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the…
- 3.1OpenSSHIn sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.
- 2.9OpenSSHIn sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is…
- 2.3AstroArbitrary CSS injection in Astro View Transitions
- LowOpenProjectUsers with "Manage Members" permission can elevate themselves by giving themselves more roles
Other vulnerabilities in WordPress plugins
18 vulnerabilities
- 8.8MainWP ChildDeserialization of untrusted data vulnerability
- 7.6uListingSettings Change
- 7.6Pubjet | پابجتSettings Change
- 7.510Web BoosterUnauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path
- 7.5Thank You Page Customizer for WooCommerceContent Injection
Show 13 more
- 7.1Dc Woocommerce Multi VendorMultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpoint
- 6.5Booster Elite for WooCommerceAuthenticated Arbitrary WordPress Option Disclosure
- 6.5워드프레스 결제 심플페이Settings Change
- 6.5PayPlug for WooCommerce (Official)Settings Change
- 6.5TrueBookerSettings Change
- 6.5WPBase CacheDenial of Service Attack vulnerability
- 5.3Flexible Quantity Measurement Price Calculator For WoocommerceOther vulnerability Type
- 5.3Order Export & Order Import for WooCommerceUnauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()
- 5.3Appointment Booking CalendarIncorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token
- 5.3Taxi Booking Manager for WooCommerceOther vulnerability Type
- 4.3Academy LMSAuthenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route
- 4.3Paid Videochat Turnkey SiteOther vulnerability Type
- 3.7Events ManagerRace Condition
Other vulnerabilities in WordPress themes
4 vulnerabilities
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.