Archive
7 January 2026
Vulnerabilities first published on this day (UTC), newest first.
225 results · Feed
-
Medium 4.3
Newsletter Email Subscribe <= 2.4 - Cross-Site Request Forgery to Plugin Settings Update
The Newsletter Email Subscribe plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4. This is due to incorrect nonce validation on the nels_settings_page function. This makes it possible for unauthenticated att…
-
Medium 6.5
Bit Form – Contact Form Plugin <= 2.21.6 - Missing Authorization to Unauthenticated Workflow Replay
The Bit Form – Contact Form Plugin plugin for WordPress is vulnerable to unauthorized workflow execution due to missing authorization in the triggerWorkFlow function in all versions up to, and including, 2.21.6. This is due to a logic flaw in the nonce verifi…
-
High 7.7
Frontend File Manager < 23.5 - Subscriber+ Arbitrary File Deletion
The Frontend File Manager Plugin WordPress plugin before 23.5 did not validate a path parameter and ownership of the file, allowing any authenticated users, such as subscribers to delete arbitrary files on the server
-
Medium 4.9
Relevanssi (Free < 4.26.0, Premium < 2.29.0) - Contributor+ SQLi
The Relevanssi WordPress plugin before 4.26.0, Relevanssi Premium WordPress plugin before 2.29.0 do not sanitize and escape a parameter before using it in a SQL statement, allowing contributor and above roles to perform SQL injection attacks
-
High 7.1
WP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site Scripting
The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including, 9.1.05.008 due to insufficient input sanitization and output escaping. This makes it possible for …
-
Medium 5.3CVE-2025-15474 Public exploit
AuntyFey Smart Combination Lock BLE Connection Flood DoS
AuntyFey Smart Combination Lock firmware versions as of 2025-12-24 contain a vulnerability that allows an unauthenticated attacker within Bluetooth Low Energy (BLE) range to cause a denial of service by repeatedly initiating BLE connections. Sustained connect…
-
Medium 4.3
AMP for WP – Accelerated Mobile Pages <= 1.1.9 - Cross-Site Request Forgery to Comment Submission
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due to inverted nonce verification logic in the amp_theme_ajaxcomments AJAX handler, which rejects requ…
-
Critical 9.3CVE-2026-0650 Scanner template
OpenFlagr <= 1.1.18 Authentication Bypass via Prefix Whitelist Path Normalization
OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper handling of path normalization in the whitelist logic, crafted requests can bypass authentication and access protected API …
-
High 7.2
Microsoft Playwright MCP Server < 0.0.40 DNS Rebinding via Missing Origin Header Validation
Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and send unauthorized requests to a locally running MCP …
-
Medium 6.5
EmailKit <= 1.6.1 - Authenticated (Author+) Arbitrary File Read via Path Traversal
The EmailKit plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.6.1. This is due to missing path validation in the create_template REST API endpoint where user-controlled input from the emailki…
-
Medium 6.4
Customer Reviews for WooCommerce <= 5.93.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via displayName Parameter
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayName' parameter in all versions up to, and including, 5.93.1 due to insufficient input sanitization and output escaping. This makes it possi…
-
High 7.8
Origin validation error issue exists in Fujitsu Security Solution AuthConductor Client Basic V2 2.0.25.0 and earlier. I…
-
Medium 5.3
WP-Members Membership Plugin <= 3.5.4.4 - Unauthenticated Information Exposure via Unprotected Files
The WP-Members Membership Plugin for WordPress is vulnerable to unauthorized file access in versions up to, and including, 3.5.4.4. This is due to storing user-uploaded files in predictable directories (wp-content/uploads/wpmembers/user_files/<user_id>/) with…
-
High 7.1
Null Pointer Dereference Vulnerability in Malformed 802.11 Frame of TP-Link Archer BE400
A NULL Pointer Dereference vulnerability in TP-Link Archer BE400 V1(802.11 modules) allows an adjacent attacker to cause a denial-of-service (DoS) by triggering a device reboot. This issue affects Archer BE400: xi 1.1.0 Build 20250710 rel.14914.
-
Medium 4.7
invoiceninja Migration Import Import.php copy server-side request forgery
A security vulnerability has been detected in invoiceninja up to 5.12.38. The affected element is the function copy of the file /app/Jobs/Util/Import.php of the component Migration Import. The manipulation of the argument company_logo leads to server-side req…
-
Medium 5.0
carboneio carbone Formatter input.js prototype pollution
A weakness has been identified in carboneio carbone up to fbcd349077ad0e8748be73eab2a82ea92b6f8a7e. This impacts an unknown function of the file lib/input.js of the component Formatter Handler. Executing a manipulation can lead to improperly controlled modifi…
-
Medium 6.8CVE-2025-66837 Public exploit
A file upload vulnerability in ARIS 10.0.23.0.3587512 allows attackers to execute arbitrary code via uploading a crafte…
-
Medium 6.5CVE-2025-66838 Public exploit
In Aris v10.0.23.0.3587512 and before, the file upload functionality does not enforce any rate limiting or throttling, …
-
High 7.5
OpenAirInterface CN5G AMF<=v2.0.1 There is a logical error when processing JSON format requests. Unauthorized remote at…
-
Medium 6.1
A stored Cross-Site Scripting (XSS) vulnerability exists in Perch CMS version 3.2. An authenticated attacker with admin…
-
High 7.5
@sylphxltd/filesystem-mcp v0.5.8 is an MCP server that provides file content reading functionality. Version 0.5.8 of fi…
-
High 7.5
fast-filesystem-mcp has a Path Traversal vulnerability
fast-filesystem-mcp version 3.4.0 contains a critical path traversal vulnerability in its file operation tools including fast_read_file. This vulnerability arises from improper path validation that fails to resolve symbolic links to their actual physical path…
-
Medium 6.5
A command injection vulnerability in the shell_exec function of sonirico mcp-shell v0.3.1 allows attackers to execute a…
-
Critical 10.0
terminal-controller-mcp vulnerable to Command Injection
A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary commands via a crafted input.
-
High 7.5
OpenAirInterface CN5G AMF<=v2.1.9 has a buffer overflow vulnerability in processing NAS messages. Unauthorized remote a…