Tagged “cve.org”
CVEs tagged cve.org, newest first.
47226 CVEsRSS
CVE-2026-109209Medium· 6.4All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC
The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_fields[embedcode]' parameter in all versions up to, and inc…
CVE-2026-97019High· 7.2AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and outp…
CVE-2026-107745Medium· 4.2AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.…
CVE-2026-118273Medium· 4.3PoCa2ui-project a2ui data-model.ts DataModel.set resource consumption
A flaw has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the function DataModel.set of the file renderers/web_core/src/v0_9/state/data-model.ts. Executing a manipulation can lead to resource consumption.…
CVE-2026-118384Medium· 6.1GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c.
GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c.
CVE-2026-118271Medium· 4.3PoCa2ui-project a2ui data-context Resolver data-context.ts resource consumption
A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component data-context Resolver. Such manipulation le…
CVE-2026-106013Critical· 9.8Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter
The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verify_twitter_callback function becaus…
CVE-2026-110879Critical· 9.8jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)
jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypass…
CVE-2026-104895High· 7.5jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service
The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD,…
CVE-2026-110747High· 7.5jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload
ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks (_inputPtr + len) <= _inputEnd using signed arithmetic. For values near Integer.MAX_VALUE the ad…
CVE-2026-116673Low· 3.3systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net
systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net
CVE-2026-54462Medium· 6.5PoCknative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion
knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion
CVE-2026-116583Medium· 5.3Seroval: Code injection through a typed array's own constructor property
Seroval: Code injection through a typed array's own constructor property
CVE-2026-117601High· 7.5Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it
Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it
CVE-2026-115927Medium· 5.3Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
CVE-2026-116575Medium· 6.3Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)
Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)
CVE-2026-116579Medium· 5.9Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)
Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)
CVE-2026-115912High· 7.5vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled
vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled
CVE-2026-115915High· 8.1vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
CVE-2026-115919Medium· 6.2ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)
ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)
CVE-2026-115920Medium· 6.2ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank
ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank
CVE-2026-112909Medium· 6.1PoCfilelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path
filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path
CVE-2026-112911Medium· 6.3PoCfilelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion
filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion
CVE-2026-112912Low· 2.5PoCfilelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker
filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker
CVE-2026-112915Medium· 5.5PoCfilelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout
filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout
CVE-2026-112934Medium· 6.1PoCfilelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its …
filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record
CVE-2026-112935Medium· 4.7PoCfilelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders
filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders
CVE-2026-112936Medium· 6.1PoCfilelock: ReadWriteLock follows a symlink at the lock path into SQLite
filelock: ReadWriteLock follows a symlink at the lock path into SQLite
CVE-2026-112939Medium· 4.7PoCfilelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker
filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker
CVE-2026-112941Low· 3.3PoCfilelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user r…
filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock