Daily summary
Vulnerabilities of 9 November 2026: 255 new, 13 critical
255 vulnerabilities added on 9 November 2026, 13 critical and 97 high: SeaweedFS (30), AVideo (5), SQL injection in servers and applications and more.
- 13 critical
- 97 high
- 122 medium
- 7 low
- 16 unrated
SeaweedFS
30 vulnerabilities · Servers and applications
- 9.8Unauthenticated admin access to the S3 Tables, Iceberg and Lance APIs
- 9.8Unauthenticated S3 IAM-cache gRPC service allows credential injection and full S3 admin takeover
- 9.8Authorization bypass via the filer `?proxyChunkId=` branch dispatching ahead of the JWT gate, enabling unauthenticated chunk read and deletion
- 9.6iam:CreateServiceAccount accepts arbitrary ParentUser - one IAM grant mints credentials that authenticate as any user, including admin
- 9.3Unauthenticated SSRF via unguarded remote-storage callers in filer and S3 gateway
Show 25 more
- 9.1STS temporary credentials are recoverable from the session token
- 9.1Unauthenticated LifecycleDelete on SeaweedFS S3 internal gRPC port allows cross-bucket object/version deletion
- 9.1aws:SourceIp policy condition is spoofable via X-Forwarded-For/X-Real-Ip behind any private-looking peer
- 9.1Stored Seaweed-X-Amz-Version-Id header enables cross-tenant filer path traversal in the S3 gateway
- 8.7Read-only Admin users can retrieve live S3 credentials
- 8.7Ambiguous S3 subresource query lets a bucket tagger replace the bucket policy
- 8.6Unauthenticated SSRF via non-s3 S3-compatible RemoteConf types bypasses the FetchAndWriteNeedle endpoint guard
- 8.2Unauthenticated SSRF port oracle and remote crash via unvalidated source address in volume server copy/tail gRPC handlers
- 8.1S3 bucket-quota permission can authorize bucket-policy modification
- 8.1DeleteBucket ignores Object Lock on directory-marker keys
- 7.5Unsupported S3 bucket-policy conditions make Allow statements unconditional
- 7.3Unauthenticated admin worker/plugin gRPC control plane binds all interfaces ignoring -ip
- 7.2Unauthenticated SSRF in SeaweedFS filer lazy-remote fetch/list/delete via unguarded GetRemoteStorage
- 7.2Cross-tenant filer write in SeaweedFS S3Tables/Iceberg REST gateways via stored metadataLocation (path traversal)
- 7.2S3 Tables MetadataLocation can recursively delete another tenant table
- HighS3 gateway gRPC port exposes the IAM and lifecycle admin services without authentication when no filer signing key is configured, allowing anyone with network…
- 6.1S3 gateway applies response header overrides (response-content-type, response-content-disposition) to anonymous requests, enabling stored XSS on publicly…
- 5.4Presigned S3 URLs can be retargeted across virtual-host buckets through X-Forwarded-Host
- 5.3Trailing-slash S3 marker objects bypass COMPLIANCE retention
- 4.3Low-privileged S3 user can determine existence of other tenants' S3Tables buckets via a 403 vs 404 oracle
- 4.3S3 query-routing mismatch lets ownership-controls authorization disclose object inventory
- MediumSTS AssumeRoleWithWebIdentity ignores trust policies when policy.defaultEffect is Allow
- MediumS3: object-scoped Write grant can change bucket configuration via the prefix query parameter
- MediumS3 bucket-policy Allow overrides an authenticated identity's explicit Deny
- MediumResidual authorization bypass after CVE-2026-55873 fix in Iceberg `stage-create`
AVideo
5 vulnerabilities · Servers and applications
- 9.8Authentication bypass / account takeover: Hybridauth social login (objects/login.json.php, plugin/MobileManager/oauth2.php) falls back to the provider's…
- 8.1Missing authorization on live_transmitions_history_id in Live restream endpoints leaks other users' stream keys and HLS URLs (incomplete fix of…
- 7.5PayPal ipnV2.php IPN branch credits the wallet of the unsigned GET json users_id with mc_gross of any PayPal-VERIFIED recurring_payment IPN, never checking…
- 4.3Missing authorization in API get_api_tags: subscribing to any tag returns raw videos rows, leaking unlisted videos (filename/title) and the stored…
- 4.3AVideo email verification bypass through loose token comparison
SQL injection in servers and applications
1 vulnerability
Privilege escalation in WordPress plugins
4 vulnerabilities
PrestaShop
19 vulnerabilities · Servers and applications · most fixed in 8.2.9, 9.2.1
- 8.8Admin API client holding api_client_write can grant itself any scope, leading to code execution
- 8.7Stored XSS through SVG files uploaded with the back-office file manager and logo uploader
- 8.5Path traversal in attachments allows file read and deletion outside the download directory
- 8.1Webservice API cross-tenant customer takeover via missing record-level shop check
- 8.1Unauthenticated PHP object injection in the installer session cookie leads to remote code execution
Show 14 more
- 8.1Installer can be re-run without an already-installed check, allowing configuration overwrite
- 8.1Webservice API multishop scope bypass via id_shop=all / id_shop_group
- 7.5Cart rule usage limits can be bypassed through a race condition in order validation
- 7.5Duplicate orders can be created from a single cart through a race condition in free-order checkout
- 7.2Arbitrary file inclusion through the module parameter of the back-office translations page allows code execution
- 7.2Remote code execution through the theme "Import from the web" feature (unrestricted file write to the admin directory)
- 7.2PHP code injection through the back-office Debug Mode cookie fields allows an employee with only the Performance permissions to execute arbitrary code
- 7.2Path traversal in theme and module import allows an authenticated administrator to write files outside the intended folder (RCE)
- 7.2Path traversal in back-office email translations allows arbitrary file write leading to remote code execution
- 7.1Admin API client disable and access-token revocation are ineffective
- 5.9Unauthenticated disclosure of a customer's customization file upload via order reference (authorization bypass in UploadController)
- 5.4PrestaShop Performance Debug Configuration PHP Code Injection
- 4.9Back-office employees with create-only order permission can modify existing orders
- 4.8Predictable password reset token allows a customer account takeover when the customer secure key is known
Apache Airflow
17 vulnerabilities · Servers and applications · most fixed in 3.4.0
- 8.8Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airflow.* classes on the API server
- 4.3Apache Airflow: API: asset queuedEvents DELETE checks Dag edit on a ?dag_id query value but deletes rows for every readable Dag
- –Apache Airflow: Import Errors API Leaks Unauthorized DAG Stack Traces via Incomplete Per-File RBAC Enforcement
- –Apache Airflow: Audit-log secrets masker redacts by key name only, persisting connection and Variable secrets in cleartext
- –Apache Airflow: CeleryExecutor: forged callback workloads run on Celery workers without workload-token validation
Show 12 more
- –Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation
- –Apache Airflow: DeadlineAlert fields bypass plugin-registration gate for scheduler-side deserialization
- –Apache Airflow: CLI argv masking misses Variable values and --conn-extra, persisting secrets in audit logs
- –Apache Airflow: Scheduler: next_kwargs deserialized before the dict check, so resume data still invokes constructors
- –Apache Airflow: Logout token revocation fails open; errors silently swallowed
- –Apache Airflow: Shell command injection in the example_dag_decorator example Dag via an IPv6 zone identifier
- –Apache Airflow: Secrets masker: pattern-based masking bounded at depth 5 returns deeply-nested registered secrets in cleartext
- –Apache Airflow: Connections API: apprise connection "config" extra returned in cleartext
- –Apache Airflow: Reserved serialization keys in Dag run conf crash the scheduler or are rebuilt as objects in the Triggerer via deadline callbacks
- –Apache Airflow: Secrets masker: camelCase key names (privateKey, connectionString, webhookUrl) not matched against the sensitive-field list
- –Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read
- –Apache Airflow: Connections API: async connection test authorizes create at enqueue but overwrites a later-created connection at commit
Payload CMS
5 vulnerabilities · Servers and applications · most fixed in 3.93.0, 4.0.0-beta.7
- 8.7Queries on blocks fields could expose read-restricted field information
- 8.7Stored XSS in @payloadcms/richtext-lexical
- 7.5Uploaded XSL files could bypass XML response protection in S3 storage
- MediumServer-side request forgery via remote URL uploads
- MediumUncontrolled resource consumption in Open Graph image endpoint
FFmpeg
121 vulnerabilities · Servers and applications
- 8.5FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Out-of-Bounds Write via APAC Decoder
- 8.5FFmpeg through 9.0.2 Heap Buffer Overflow via LCEVC Enhancement Decoding
- 8.5FFmpeg through 9.0.2 Heap Buffer Overflow via ProRes prores_ks Encoder
- 8.5FFmpeg through 9.0.2 GIF Encoder Heap Buffer Overflow via shrunk_buf Remap
- 8.5FFmpeg before 8.1.3 and 9.x before 9.0.2 VVC Decoder Out-of-Bounds Write via sh_entry_points
Show 116 more
- 8.5FFmpeg through 9.0.2 Heap Buffer Overflow via DVB Subtitle Encoder
- 8.5FFmpeg through 9.0.2 Out-of-Bounds Memory Access in Huffyuv/FFVHUFF Median Predictor
- 8.5FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Buffer Overflow via dvdsubenc.c
- 8.5FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Buffer Overflow in Cook Multichannel Decoder
- 7.3FFmpeg through 9.0.2 Double Free via cbs_sei_delete_message in cbs_sei.c
- 7.3FFmpeg through 9.0.2 Heap Buffer Overflow in EXR Encoder RLE Path
- 7.3FFmpeg through 9.0.2 Heap Overflow via Nellymoser Encoder Trellis Search
- 7.3FFmpeg through 9.0.2 Heap Buffer Overflow via RISC-V Vector diff_bytes Routine
- 7.3FFmpeg through 9.0.2 VVC Decoder Heap Out-of-Bounds Write via refs.c
- 7.3FFmpeg 7.1 through 9.0.2 Heap Out-of-Bounds Write via Vulkan Slice Buffer Sizing
- 7.3FFmpeg 9.0 through 9.0.2 Integer Overflow via FFV1 Vulkan Encoder Remap Buffer
- 7.3FFmpeg through 9.0.2 Heap Buffer Overflow via FLIC Decoder check_pixel_ptr
- 7.3FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC DXVA Tile Parameters
- 7.3FFmpeg through 9.0.2 Heap Overflow via QSV Encoder submit_frame()
- 7.3FFmpeg through 9.0.2 Heap Buffer Overflow via cbs_jpeg_write_scan Integer Overflow
- 7.3FFmpeg through 9.0.2 Heap Buffer Overflow via hap_parse_frame_header()
- 7.3FFmpeg through 9.0.2 APNG Encoder Heap Buffer Overflow via encode_apng()
- 7.3FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC VDPAU Tile Arrays
- 7.3FFmpeg through 9.0.2 Heap Buffer Overflow in Blu-ray PCM Decoder
- 7.3FFmpeg through 9.0.2 Heap Buffer Overflow via PSD Decoder RLE Path
- 7.3FFmpeg through 9.0.2 Heap Corruption via libaribcaption ASS Error Cleanup
- 7.3FFmpeg through 9.0.2 Heap Buffer Overflow via VideoToolbox Encoder
- 7.3FFmpeg through 9.0.2 Heap Overflow in libaribcaption Text Subtitle Decoding
- 7.3FFmpeg through 9.0.2 V4L2 M2M Encoder Out-of-Bounds Write in v4l2_buffers.c
- 7.3FFmpeg through 9.0.2 Heap Buffer Overflow in libwebp Encoder Conditional Replenishment
- 7.3FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC VAAPI Tile Arrays
- 7.3FFmpeg 7.0 before 8.1.3 and 9.x before 9.0.2 Heap Overflow via vulkan_av1.c
- 7.3FFmpeg through 9.0.2 Heap Buffer Overflow via liboapv APV Encoder Wrapper
- 7.3FFmpeg through 9.0.2 FLIC Decoder Out-of-Bounds Write via FLI_BRUN Byte Swap
- 6.9FFmpeg through 9.0.2 SGI Encoder Out-of-Bounds Read via sgienc.c
- 6.9FFmpeg through 9.0.2 Heap Out-of-Bounds Read via LCL/ZLIB Multithread Decoding
- 6.9FFmpeg through 9.0.2 Out-of-Bounds Read via bitpacked_decode_uyvy422()
- 6.9FFmpeg through 9.0.2 Out-of-Bounds Heap Read via TDSC Cursor Dimensions
- 6.9FFmpeg through 9.0.2 Out-of-Bounds Read via libxevd EVC NAL Length
- 6.9FFmpeg through 9.0.2 Out-of-Bounds Read in Musepack SV7 Decoder via mpc7.c
- 6.8FFmpeg through 9.0.2 CPU Exhaustion via JPEG XL Parser TOC Count
- 6.8FFmpeg through 9.0.2 Division by Zero via VVC ff_vvc_slice_rpl()
- 6.8FFmpeg through 9.0.2 Resource Leak in libsvtjpegxs JPEG XS Decoder Wrapper
- 6.8FFmpeg through 9.0.2 Reachable Assertion in libxevd EVC Decoder Wrapper
- 6.8FFmpeg through 9.0.2 WavPack Encoder Integer Overflow Infinite Loop via wavpack_encode_init
- 6.8FFmpeg 4.4 through 9.0.2 NULL Pointer Dereference via adx_decode_header()
- 6.8FFmpeg through 9.0.2 Division by Zero in B-frame Motion Estimation
- 6.8FFmpeg through 9.0.2 Integer Overflow Division by Zero via pcm_rechunk Filter
- 6.8FFmpeg through 9.0.2 Excessive Memory Allocation via SBaGen Demuxer
- 6.8FFmpeg through 9.0.2 NULL Pointer Dereference via aac_adtstoasc Bitstream Filter
- 6.8FFmpeg through 9.0.2 Vorbis Parser CPU Exhaustion via Invalid Extradata
- 6.8FFmpeg through 9.0.2 Uncontrolled Recursion in FLAC Parser score_header()
- 6.8FFmpeg through 9.0.2 Mimic Decoder Deadlock via Frame Threading Failure
- 6.8FFmpeg through 9.0.2 DPX Encoder NULL Pointer Dereference via encode_gbrp12()
- 6.8FFmpeg through 9.0.2 Excessive Memory Allocation via Interplay ACM Decoder
- 6.8FFmpeg through 9.0.2 Memory Exhaustion via av1_frame_merge Bitstream Filter
- 6.8FFmpeg through 9.0.2 Memory Leak via libx265 Dolby Vision RPU Payloads
- 6.8FFmpeg through 9.0.2 Memory Leak in VC-1 Decoder via vc1_decode_frame()
- 6.8FFmpeg through 9.0.2 Out-of-Bounds Read via PCM DVD Encoder
- 6.8FFmpeg through 9.0.2 TTA Encoder Reachable Assertion via tta_encode_frame()
- 6.8FFmpeg through 9.0.2 Division by Zero via AFGS1 Film Grain Scaling Points
- 6.8FFmpeg through 9.0.2 Denial of Service via HEVC PPS 3D Extension Parsing
- 6.8FFmpeg 8.1 through 9.0.2 EXIF Parser Memory Exhaustion via Overlapping Tags
- 6.8FFmpeg before 8.1.3 and 9.x before 9.0.2 NULL Pointer Dereference via ff_hap_set_chunk_count()
- 6.8FFmpeg through 9.0.2 Memory Leak in libxevd EVC Decoder Wrapper
- 6.8FFmpeg through 9.0.2 Memory Exhaustion DoS via APE Decoder apedec.c
- 6.8FFmpeg through 9.0.2 Infinite Loop Denial of Service via IMC/IAC Decoder
- 6.8FFmpeg through 9.0.2 NULL Pointer Dereference in EA TQI Decoder
- 6.8FFmpeg through 9.0.2 NULL Pointer Dereference in Bink Video Decoder
- 6.8FFmpeg through 9.0.2 VBLE Decoder NULL Pointer Dereference via vble_decode_frame()
- 6.8FFmpeg through 9.0.2 NULL Pointer Dereference via TGV Decoder eatgv.c
- 6.8FFmpeg through 9.0.2 NULL Pointer Dereference in CLJR Video Decoder
- 6.8FFmpeg through 9.0.2 NULL Pointer Dereference in G.726 ADPCM Decoder
- 5.8FFmpeg through 9.0.2 Heap Out-of-Bounds Read in V4L2 M2M Encoder
- 5.8FFmpeg through 9.0.2 Use-After-Free via NVDEC Stale Bitstream Pointer
- 5.8FFmpeg through 9.0.2 Use-After-Free in MJPEG Hardware-Accelerated Decoding
- 5.8FFmpeg through 9.0.2 VP9 CBS Superframe Integer Overflow Out-of-Bounds Read
- 5.8FFmpeg before 8.1.3 and 9.x before 9.0.2 Out-of-Bounds Read in Vorbis Encoder
- 5.7FFmpeg 9.0 through 9.0.2 Memory Exhaustion via LCEVC Enhancement Dimensions
- 5.7FFmpeg through 9.0.2 Division by Zero via dovi_configure_ext() in dovi_rpuenc.c
- 5.7FFmpeg through 9.0.2 VAAPI Memory Leak via Abandoned Picture Buffers
- 5.7FFmpeg through 9.0.2 Assertion Failure DoS via cbs_jpeg_assemble_fragment
- 5.7FFmpeg through 9.0.2 Memory Leak in MJPEG Hwaccel SOF Decoding
- 5.7FFmpeg through 9.0.2 Memory Leak via VDPAU Hwaccel Bitstream Buffer Table
- 5.7FFmpeg 8.1 through 9.0.2 Denial of Service via DPX Vulkan Hwaccel Error Path
- 5.7FFmpeg 8.0 through 9.0.2 Memory Leak in VP9 Decoder via vp9_decode_frame
- 5.7FFmpeg 7.1 through 9.0.2 NULL Pointer Dereference via ff_dovi_rpu_generate()
- 5.7FFmpeg through 9.0.2 V4L2 M2M Decoder Deadlock via Reference Count Leak
- 5.7FFmpeg 8.1 through 9.0.2 Denial of Service via lcevc_metadata Bitstream Filter
- 5.7FFmpeg through 9.0.2 CPU Exhaustion via dts2pts Bitstream Filter
- 5.7FFmpeg through 9.0.2 NULL Pointer Dereference in JV Video Decoder
- 5.7FFmpeg through 9.0.2 NULL Pointer Dereference in MPEG Audio Decoder
- 5.7FFmpeg through 9.0.2 NULL Pointer Dereference via Motion Pixels Decoder
- 4.8FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure in CFHD Decoder
- 4.8FFmpeg through 9.0.2 Uninitialized Stack Memory Disclosure via SANM Codec 23
- 4.8FFmpeg through 9.0.2 Integer Overflow via dng_decode_tiles() in libavcodec/tiff.c
- 4.8FFmpeg through 9.0.2 Uninitialized Memory Disclosure via JPEG-LS Decoder
- 4.8FFmpeg through 9.0.2 VVC Decoder Memory Leak via alloc_frame()
- 4.8FFmpeg through 9.0.2 RoQ DPCM Encoder Uninitialized Heap Memory Disclosure
- 4.8FFmpeg through 9.0.2 Heap Memory Disclosure via DXA Decoder Uninitialized Buffer
- 4.8FFmpeg through 9.0.2 Uninitialized Stack Memory Disclosure via MVC2 Decoder
- 4.8FFmpeg 6.1 through 9.0.2 Information Disclosure via CamStudio Decoder cscd.c
- 4.8FFmpeg through 9.0.2 Out-of-Bounds Read via Cook Decoder js_subband_start
- 4.8FFmpeg through 9.0.2 Heap Memory Disclosure via VQA Video Decoder
- 4.8FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure via MSCC/SRGC Decoder
- 4.8FFmpeg through 9.0.2 Uninitialized Memory Read in Flash Screen Video 2 Decoder
- 4.8FFmpeg through 9.0.2 Information Disclosure via Flash Screen Video Decoder
- 4.8FFmpeg through 9.0.2 Uninitialized Memory Disclosure via targa_decode_rle()
- 4.8FFmpeg through 9.0.2 Uninitialized Heap Disclosure via MLZ Decompressor in ALS Decoder
- 4.8FFmpeg through 9.0.2 VMnc Decoder Uninitialized Heap Memory Disclosure
- 4.8FFmpeg through 9.0.2 TAK Decoder Uninitialized Memory Disclosure via takdec.c
- 4.8FFmpeg through 9.0.2 Integer Overflow in OpenEXR Decoder Tile Count
- 4.8FFmpeg through 9.0.2 WebP Decoder Information Disclosure via Short ALPH Chunk
- 4.8FFmpeg through 9.0.2 Uninitialized Memory Disclosure via GEM Raster Decoder
- 4.8FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure via rawdec.c Raw Video Decoder
- 4.8FFmpeg through 9.0.2 C93 Decoder Uninitialized Stack Memory Disclosure
- 4.8FFmpeg through 9.0.2 Uninitialized Memory Disclosure via Tiertex SEQ Decoder
- 2.0FFmpeg through 9.0.2 Out-of-Bounds Read via prores_ks Interlaced Alpha Encoding
- 2.0FFmpeg through 9.0.2 Memory Leak via MediaCodec JNI setBuffer
- 2.0FFmpeg through 9.0.2 Uninitialized Memory Disclosure via ADPCM_MS Trellis Encoding
- 2.0FFmpeg through 9.0.2 ProRes prores_aw Heap Out-of-Bounds Read in Interlaced Encoding
WS_FTP Server
6 vulnerabilities · Servers and applications · most fixed in 2025.0.5
- 8.1Insecure XFT Transport in Progress WS_FTP Server
- 7.7Unauthorized File Disclosure via Path Traversal in Thin Client Web Transfer in Progress WS_FTP Server
- 7.5Unauthenticated XFT Memory Exhaustion in Progress WS_FTP Server
- 7.1Insecure Storage of Web Transfer Credentials in Progress WS_FTP Server
- 6.5FTP Quota Accounting Bypass in Progress WS_FTP Server
- 6.3Folder Permission Bypass in Progress WS_FTP Server
Broken access control in WordPress plugins
4 vulnerabilities
Cross-site scripting in WordPress plugins
26 vulnerabilities
- 7.1Broadcast Live Video
- 7.1JetFormBuilder
- 7.1Invoice Gateway for WooCommerce – Invoice Payment Gateway
- 7.1Mang Board WP
- 7.1Featured Image from URL
Show 21 more
- 7.1RSVP and Event Management
- 7.1If-So Dynamic Content Personalization
- 7.1Form Maker by 10Web
- 7.1Welcart e-Commerce
- 7.1Checkout Files Upload for WooCommerce
- 7.1Frontend Admin by DynamiApps
- 7.1FV Flowplayer Video Player
- 7.1JetFormBuilder
- 7.1Flying Images
- 7.1Review Schema
- 7.1WP Inventory Manager
- 6.5WP Activity Log
- 6.5ShopEngine
- 6.5Directorist
- 6.5WP Customer Area
- 6.5TI WooCommerce Wishlist
- 6.5Mang Board WP
- 6.5All-in-One Video Gallery
- 6.5Directorist
- 6.5Hummingbird
- 6.5Motors
Cross-site scripting in servers and applications
3 vulnerabilities
Other vulnerabilities in servers and applications
8 vulnerabilities
- 9.1Parse ServerGoogle Play Games auth adapter accepts a player ID that the access token does not belong to
- 8.6WebminWebmin through 2.670 OS Command Injection via Samba User Account Options
- 6.3Python`http.cookiejar` applies expired `Set-Cookie` to cookie store before policy validation
- 5.3vLLMThinking-budget sparse state aliases onto a co-batched request during a mixed `SWAP`, forcing the reasoning-end token into another request's output
- 4.8vLLMCross-user token data leakage in async scheduling + Pipeline Parallelism
Show 3 more
- –Pythonssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity
- 3.3ImageMagickInformation Disclosure in distributed pixel cache server when monitoring local unencrypted traffic.
- LowAstroImage endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems
Other vulnerabilities in WordPress plugins
6 vulnerabilities
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.