Archive
21 August 2026
Vulnerabilities first published on this day (UTC), newest first.
258 results · Feed
-
High 7.2
WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values
The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it poss…
-
High 7.8
GPU DDK - rgxfw_to_ptr() does not reject FW private data pointers
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands to the GPU which result…
-
Medium 4.3
Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP meth…
-
High 7.5
Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpo…
-
High 7.7
Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check
A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the `spec.namespace` field. This allows the tenant to spec…
-
Low 3.3
Missing authentication for critical function vulnerability exists in VOCALOID6. Any process running under the same loca…
-
Medium 5.3
Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCAL…
-
Critical 9.3
Datiphy Data Management Center - External Control of File Name or Path
External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path se…
-
High 8.8
Datiphy Data Management Center - Missing Authentication for Critical Function
Missing authentication for a critical function in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an unauthenticated remote attacker to upload arbitrary files to the server's configured upload directory.
-
Medium 6.3
SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP submit.php saveUser sql injection
A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /public/submit.php. This manipulation of the argument Researcher causes sql injection. The attack may b…
-
Critical 9.4
Datiphy Data Management Center - Improper Neutralization of Special Elements used in an OS Command
OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root.
-
Critical 9.3
Datiphy Data Management Center - Use of Default Credentials
Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials.
-
Medium 4.3
SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP cross-site request forgery
A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit has be…
-
Critical 9.8
The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate…
-
Critical 9.8
The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the…
-
Critical 9.8
The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crat…
-
Low 2.4
This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with phys…
-
Medium 4.3
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS T…