Tagged “cve.org”
CVEs tagged cve.org, newest first.
47291 CVEsRSS
CVE-2026-114743Low· 3.1InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settings
The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low…
CVE-2026-114742Low· 2.7WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.
CVE-2026-114741Low· 3.8WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users.
CVE-2026-116047Medium· 4.3PoCPrivoce Vocechat Query Parameter widget.html cross site scripting
A vulnerability has been found in Privoce Vocechat up to 0.9.121. This issue affects some unknown processing of the file widget.html of the component Query Parameter Handler. Such manipulation of the argument welcome leads to cross site …
CVE-2026-116046Medium· 5.3eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal
A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manip…
CVE-2026-116045Medium· 4.3PoC1999AZZAR designer-mcp MCP motion-dev-guidelines.md get_reference path traversal
A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.0. This affects the function get_reference of the file skills/motion-designer/references/motion-dev-guidelines.md of the component MCP Interface. The manipulation of the ar…
CVE-2026-115214Critical· 9.8Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headers
The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authent…
CVE-2026-116050High· 7.3PoCkrupalshah Employee Recruitment System Registration registerform3.php sql injection
A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects an unknown part of the file /source/registerform3.php of the component Registration. The manipulation o…
CVE-2026-116049High· 7.3PoCkrupalshah EmployeeRecruitmentSystem Registration Wizard registerform2.php mysql_query sql injection
A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file /source/registerform2.php of the component Registration Wizard. …
CVE-2026-116048High· 7.3PoCkrupalshah EmployeeRecruitmentSystem Registration registerform1.php mysql_query sql injection
A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of the file /source/registerform1.php of the component Regist…
CVE-2026-116070Medium· 6.5PoCDocker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/config
Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite configuration via /api/config. Attackers can retrieve the WeChat webh…
CVE-2026-116069Medium· 6.5NiubiGEO before 0.3.2 Unauthenticated SSRF via /audit-plan domain Field
NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addresses by supplying a crafted domain value to POST /audit-plan. Attackers can s…
CVE-2026-116067High· 8.2PoCPaisa before 0.7.8 Path Traversal via Editor and Sheet API
Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. At…
CVE-2026-116066Medium· 6.8PoCFirecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright Service
Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target ca…
CVE-2026-116137Low· 3.7adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names
adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives wh…
CVE-2026-116072Medium· 5.4Infinity for Reddit through 8.3.4 OAuth Login CSRF via LoginChromeCustomTabActivity
Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account because the exported LoginChromeCustomTabActivity redirect handler check…
CVE-2026-116071Medium· 5.9rotki before 1.44.2 Weak Key Derivation for Premium Cloud Backup Encryption
rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob ca…
CVE-2026-116068High· 8.8Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router
Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like …
CVE-2026-116136Medium· 5.9ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking
ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an inter…
CVE-2026-116073Medium· 6.5Leon before commit 50df142 Path Traversal via /download model Command
Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL() that allows attackers to write files outside the models directory via percent-encoded separators. Attackers can trick a user into running '/d…
CVE-2026-116146Low· 3.7ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoder
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the MSL decoder that fails to release allocated memory when processing a crafted MSL image. Attackers can supply crafted MSL files for processing to repeatedl…
CVE-2026-116139Medium· 5.4WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering
WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows authenticated commenters to inject JavaScript because markDownToHTML() preserves event-handler attributes in leading HTML blocks. Attackers …
CVE-2026-116052Medium· 4.3LinkStackOrg LinkStack cross-site request forgery
A security flaw has been discovered in LinkStackOrg LinkStack up to 4.8.8. The affected element is an unknown function. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. The v…
CVE-2026-116143Low· 3.3ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass in PS, PDF and XPS Decoders
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a policy bypass in the PS, PDF and XPS decoders that allows the security policy's list length limit on scene selection to be circumvented. Attackers supplying a specific argum…
CVE-2026-116142Low· 3.3ImageMagick before 7.1.2-33 Heap Buffer Over-Read via Minimum-Bounding-Box
ImageMagick before 7.1.2-33 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory when printing a minimum-bounding-box. Attackers can supply a crafted image that triggers the over-read durin…
CVE-2026-116141Medium· 5.3ImageMagick before 7.1.2-33 Policy Bypass in UHDR Decoder
ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur after decoding. Attackers can supply crafted UHDR images with…
CVE-2026-116147Low· 3.7ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Null Pointer Dereference in DJVU Decoder
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a null pointer dereference in the DJVU decoder because the result of a memory allocation is not checked before use. Attackers can supply a DJVU image that, when processed unde…
CVE-2026-116145Low· 3.9ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 Security Policy Bypass via Incomplete Fix
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 contains a security policy bypass caused by an incomplete fix for the policy bypass reported in GHSA-jjp4-3fwf-393j. An attacker able to supply input to ImageMagick can evade configure…
CVE-2026-116144Low· 3.3ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Overflow via MVG Decoder
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains uncontrolled recursion in the MVG decoder that can lead to a stack overflow. Attackers can supply a crafted MVG file that, when read with specific arguments, exhausts the stac…
CVE-2026-116140Low· 3.3ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass via Delegate Invocation Parsing
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate invocations, which can allow an executable blocked in policy.xml to still run. An attacker who gets ImageMagick to process input that triggers a delegate in…