Archive
3 September 2026
Vulnerabilities first published on this day (UTC), newest first.
349 results · Feed
-
Critical 9.8
WordPress YITH Request a Quote for WooCommerce Premium plugin < 4.46.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.
-
High 8.8
WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability
Contributor PHP Object Injection in RTMKit <= 2.1.5 versions.
-
Medium 6.5
WordPress Timetics plugin <= 1.0.61 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions.
-
High 7.1
WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions.
-
High 7.1
WordPress WP QuickLaTeX plugin <= 3.8.8 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions.
-
High 7.1
WordPress Calculation For Contact Form 7 plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions.
-
High 7.1
WordPress Under Construction plugin <= 5.82 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions.
-
High 7.1
WordPress Simple Payment plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions.
-
Medium 6.5
WordPress Product Variations Swatches for WooCommerce plugin <= 1.1.18 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions.
-
Medium 6.5
WordPress Graphene theme <= 2.9.4 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions.
-
Medium 6.5
WordPress Pre-Orders for WooCommerce plugin <= 2.3 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce <= 2.3 versions.
-
Medium 6.9
Server-Side Request Forgery via Favicon Redirect to Local Network Resources in PlaywrightCapture
PlaywrightCapture contains a server-side request forgery (SSRF) vulnerability in its favicon retrieval functionality. When only_global_lookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other no…
-
High 8.3
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federat…
-
High 7.3
SeaCMS WeChat index.php addslashes sql injection
A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launched remotely. The exp…
-
High 7.1
MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service
A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypass validation of the template definition field. The EventTemplate::beforeValidate() method only performed semantic valid…
-
High 7.6
Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking
MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rot…
-
Medium 5.1
pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small
pymonocypher uses cython to wrap the Monocypher C library. Prior to version 4.0.2.8, the argon2i_32 implementation does not check the nb_blocks size. If the caller does not provide a sufficiently large buffer based on the API contract, then argon2i_32 will wr…
-
High 7.1
ColdFusion | Improper Authentication (CWE-287)
ColdFusion is affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain limited read and write access. The vulnerable component is restricted to an administrative netw…
-
Medium 5.3
Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark
Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() …
-
High 8.6
Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass
A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The email_otp() endpoint did not apply brute-force protection when validating submitted OTP v…
-
High 7.5
Signum Node: Integer overflow in SMART_FEES fee distribution allows arbitrary miner reward inflation
Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment (PoC+) consensus algorithm. Prior to version 3.9.9, an integer overflow in BlockServiceImpl.applyBlock() allowed a miner to receive an arbitrarily inflated block …
-
High 8.8CVE-2026-71963 Public exploit
Hermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config Injection
Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an at…
-
Medium 4.3
Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal
A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized…
-
High 8.7
Gardens v2: Permissionless syncOutflow bypasses streaming proposal disputes
Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. Prior to 0xc9d4e0dacd937364793278180551e59d93cd43f9, StreamingEscrow.claim() correctly rej…
-
High 8.7
Gardens v2: Approve-side dispute resolution drains active streaming escrow reserve
Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. In dfba919e218e20d52db9f7b2e8d292d45a46c91b and prior, normal beneficiary payout paths in …
-
High 7.7
Gardens v2: StreamingEscrow buffer drains to the proposal beneficiary on cancel via the permissionless claim()
Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. In 3e595f3 and prior, when a streaming proposal is funded, the cluster of streaming contra…
-
Medium 5.5
Exterro FTK Imager < 8.3 XXE via Report.xml XSLT Processing
Exterro FTK Imager before 8.3 contains an XML external entity (XXE) injection vulnerability that allows attackers to read arbitrary files from the host filesystem by embedding malicious external entity references and attacker-controlled XSLT stylesheets withi…
-
Medium 5.3
Fleet: DNS exfiltration via Sprig getHostByName in fleet.yaml Helm template preprocessing
A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a…
-
High 7.3
SeaCMS Locoy Collector seacms_locoy_news.php parseIf code injection
A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms_locoy_news.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated re…
-
High 8.8
MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request
A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests. Because bodyless GET requests are not subject to CakePHP's C…
-
High 7.7
Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass
A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could ther…
-
Medium 4.2
Authenticated KMS request forgery via CRLF injection in GCP key identifier strings
An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side…
-
Medium 5.3
Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser
An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success …
-
Medium 5.9
Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client
A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be r…
-
Medium 5.1
Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds
An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated pa…
-
High 7.4
Rancher: SAML Assertion Replay
A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In a high-availability …
-
Medium 5.1
BSON element injection via NUL-embedded document keys in builder append
An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the libra…
-
Low 3.7
Heap overflow via truncated base64 encoding of binary fields in length-limited JSON output
A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who …
-
Medium 6.5
Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path
Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an applicat…
-
High 7.7
Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing
A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io/projectId` annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namesp…