Tagged “cve.org”
CVEs tagged cve.org, newest first.
46469 CVEsRSS
CVE-2026-120534Critical· 9.8Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configurati…
CVE-2026-120575Medium· 6.4Photo Engine (Media Organizer & Lightroom) <= 6.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection Name
The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hierarchy[].name' parameter in all versions up to, and including, 6.5.7 due to insufficient input sanitization and …
CVE-2026-120558High· 7.2Advanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameter
The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the `tracking_provider` parameter of the `POST /wp-json/wc-ast/v3/orders/<order_id>/shipment-trackings` REST endpoint in all versions …
CVE-2026-105982High· 7.2Command Injection in IPsec VPN
Improper input validation in the IPsec VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.
CVE-2026-118446Medium· 6.9Use-after-free in INSTRUX array members in pybddisasm
A use-after-free vulnerability in the pybddisasm Python bindings affects array-valued members of INSTRUX objects, including ND_OPERAND arrays. These arrays are exposed as Python lists whose elements reference memory owned by the parent I…
CVE-2026-118444Medium· 4.8Out-of-bounds reads during instruction decoding in pybddisasm
Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nd_decode function may read up to 15 bytes without checking the actual length of the supplied Pyth…
CVE-2026-118448Medium· 6.9Uninitialized output buffer returned after nd_to_text failure in pybddisasm
A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects nd_to_text. If the underlying text conversion fails, including failures caused by invalid parameters, the output buffer may remain uninitialized while …
CVE-2026-118445Medium· 6.9Use-after-free in INSTRUX structure members in pybddisasm
A use-after-free vulnerability in the pybddisasm Python bindings affects structure-valued members of INSTRUX objects. These members are exposed through Python objects that reference memory owned by the parent INSTRUX object. A retained r…
CVE-2026-120332Medium· 5.1Cross-Site Scripting in extension "Mail" (mail)
The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewi…
CVE-2026-120331Medium· 5.3Server-Side Request Forgery in extension "Mail" (mail)
Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal net…
CVE-2026-118447Medium· 4.8Uninitialized INSTRUX contents returned after decoding failure in pybddisasm
A use of uninitialized memory vulnerability in the pybddisasm Python bindings may disclose process memory when instruction decoding fails. The nd_decode, nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions may return an INS…
CVE-2026-120329Medium· 5.3Broken Access Control in extension "Mail" (mail)
Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the module. Backend users with access to the mail module can write arbitrary page…
CVE-2026-120328Medium· 6.9Information Disclosure in extension "Mail" (mail)
The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.
CVE-2026-120327Medium· 5.3Open Redirection in extension "Mail" (mail)
The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links to the website to redirect users to external sites.
CVE-2026-121396Medium· 4.3FreeRDP 3.0.0 before 3.32.2 denial of service via RTS padding assertion
FreeRDP clients from 3.0.0 before 3.32.2 built with verbose WinPR assertions contain a reachable assertion in rts_read_auth_verifier triggered by malformed RTS padding. Attackers controlling an RD Gateway can send a crafted RPC-over-HTTP…
CVE-2026-121392High· 7.4FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate
FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tls_verify_certificate() that accepts Common Name fallback despite non-matching SAN entries and matches IP literals against DNS strings. Man-in-the-middle…
CVE-2026-121458Medium· 6.5Instatic before 0.0.21 Authorization Bypass via MCP Content Read Tools
Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other u…
CVE-2026-121404Medium· 6.5FreeRDP before 3.32.2 Shadow Server CPU Exhaustion via Zero-Length DVC DATA
FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened…
CVE-2026-121408Medium· 5.3FreeRDP before 3.32.2 Use-After-Free via USB Redirection Control Channel
FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns a channel pointer without a reference and the control-channel close path does not take the device manager's loading_loc…
CVE-2026-121400Medium· 6.5FreeRDP before 3.32.2 CPU Exhaustion via RDG Control Packet
FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdg_process_control_packet that allows a malicious RD Gateway to exhaust client CPU by sending an incomplete keepalive control packet. Attackers completing the RDG tunne…
CVE-2026-121547Low· 2.2dysk before 3.8.2 Terminal Escape Sequence Injection via Mount Metadata
Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject control sequences by crafting mount metadata rendered unsanitized in table and CSV output. Attackers can create FUSE mo…
CVE-2026-121416High· 7.1SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations
SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because MethodPart::evaluate invokes resolved functions without a capability check. Authenticated users who c…
CVE-2026-121412Medium· 6.5FreeRDP 3.0.0 before 3.32.2 Proxy Memory Exhaustion via DVC Reassembly
FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap memory via intercepted DVC message reassembly. Attackers can declare a large DATA_FIRST len…
CVE-2026-65109Medium· 4.7NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove files outside of their control on the compute node.
NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove files outside of their control on the compute node.
CVE-2026-121420Low· 3.3SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addresses
SurrealDB from 3.2.0 before 3.3.0 contains a server-side request forgery vulnerability in the FilteringResolver is_private_ip check that fails to unwrap NAT64, 6to4, and Teredo IPv6 addresses. Authenticated users triggering outbound HTTP…
CVE-2026-121428High· 8.8AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone
AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines…
CVE-2026-121424Medium· 6.5Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit …
CVE-2026-121436High· 7.2Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php
Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customers_see_all to view every account's API key and secret through an unscoped WHERE 1 query in api_keys.php. Attackers c…
CVE-2026-121452Medium· 6.5bbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email Service
bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail() sets InsecureSkipVerify to true. Attackers can present any certificate …
CVE-2026-121444High· 7.5svg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference Graph
svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of service vulnerability in hasInfiniteLoop() and countUse() of the use reference-graph analysis. Attackers can upload a small layered SVG with 15 levels of…