Archive
28 August 2026
Vulnerabilities first published on this day (UTC), newest first.
162 results · Clear filters · Feed
-
Medium 5.3
Everest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'
The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_value()` method in `class-evf-form-task.php` accepting arbitrary URL values from `$_POST` …
-
Medium 6.4
Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description
The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possi…
-
Medium 5.9
Unbounded recursion between Inspect.List charlist rendering and List.to_string/1 error path in Elixir
Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_charlist/1 to exhaust a BEAM node's memory. Inspect.List's charlist branch in lib/elixir/lib/inspect.e…
-
Medium 4.3
iswalle getnote-mcp upload_image index.ts fs.readFileSync path traversal
A vulnerability was detected in iswalle getnote-mcp up to 1.5.0. The affected element is the function fs.readFileSync of the file src/index.ts of the component upload_image. Performing a manipulation of the argument image_path results in path traversal. The a…
-
Medium 5.9
SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch
SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from o…
-
Medium 4.3
SvelteKit before 2.69.1 Prototype Pollution via File Input
SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, poten…
-
Medium 5.3
SvelteKit before 2.69.1 Denial of Service via Remote Form
SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process.
-
Medium 6.8
gitoxide 0.25.4 HTTP Credential Leak via Redirect
gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the o…
-
Medium 6.5
gitoxide gix-packetline before 0.21.5 Denial of Service
gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index o…
-
Medium 5.3
gitoxide before 0.33.0 Path Traversal via symlink following
gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_worktree_state::checkout() follows an existing terminal symlink during non-exclusive (incremental) materialization (destination_is_initially_empty: f…
-
Medium 5.9
filebrowser through 2.63.23 Denial of Service via named pipes
filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscalls. Authenticated users or anonymous visitors with public share links can repeatedly request archive…
-
Medium 5.7
SiYuan before v3.8.1 Path Traversal via asset.upload
SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without workspace boundary validation. Attackers can induce the AI Agent to upload sensitive files such as SSH keys or credent…
-
Medium 5.1
WWBN AVideo through 30.0 CSRF via myLiveControls.save.json.php
WWBN AVideo through 30.0 (and master up to commit 4cb576e) contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedir…
-
Medium 6.9
WWBN AVideo through 30.0 Information Disclosure via report4.json.php
WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoints, allowing unauthenticated access to user registration statistics. Attackers can send GET requests to these endpoints to retrieve daily an…
-
Medium 6.5
An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its…
-
Medium 6.5
An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression s…
-
Medium 4.3
A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process…
-
Medium 4.3
An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to …
-
Medium 4.3
Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentic…
-
Medium 5.9
An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more th…
-
Medium 5.9
An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin …
-
Medium 6.5
An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal h…
-
Medium 4.3
An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid command…
-
Medium 6.5
An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disp…
-
Medium 4.3
An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an…
-
Medium 4.3
An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial o…
-
Medium 4.8
Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator…
-
Medium 5.9
An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a …
-
Medium 4.3
When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused …
-
Medium 5.3
WordPress Essential Addons for Elementor plugin <= 6.8.0 - Bypass vulnerability vulnerability
Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons for Elementor: from n/a through 6.8.0.
-
Medium 5.4
Ffmpeg: ffmpeg: heap buffer overflow in tdsc_load_cursor() via cur_fmt_mono cursor
A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a specially crafted video file, potentially leading to …
-
Medium 5.3
Joomla Extension - j2commerce.com - Reflected XSS attribute in All Video Share 1.0.0-4.5.0
Joomla Extension - mrvinoth.com - Reflected XSS in All Video Share 1.0.0-4.5.0 - Various user supplied inputs lacked escaping, leading to reflected XSS vectors
-
Medium 6.9CVE-2026-78070 Public exploit
Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2
Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2 - Saving an article can trigger a blind SQL injection with content plugin, needs update permission for articles.
-
Medium 6.4
GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'give_form' shortcode in all versions up to, and including, 4.14.4. This is due to insufficient input sanitization and output escap…
-
Medium 6.4
All-in-One WP Migration Unlimited Extension <= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter
The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wm_backups_path' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output esca…
-
Medium 6.5
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain…
-
Medium 4.3
A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote a…
-
Medium 6.5
WordPress Loops & Logic - Reflected XSS
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Tangible Loops & Logic.
-
Medium 5.4
SOY Gallery contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of th…
-
Medium 5.4
SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of t…