Newest vulnerability reports across all tracked categories.
SQL injection (CWE-89) in the affiliate-toolkit WordPress plugin before 3.8.9: an unvalidated user-supplied sort value on an editor-reachable admin list screen lets editors and above read arbitrary database data; on multisite, a sub-site editor…
Astron Agent prior to 1.1.2 runs workflow code-node code through LocalExecutor with complete Python builtins and no sandbox, letting an authenticated low-privilege tenant execute code as root in the core-workflow container, bypass tenant isolation…
SGLang 0.5.10 through 0.5.22 exposes an unauthenticated /dumper/configure endpoint when DUMPER_SERVER_PORT is set; _evaluate_filter() evaluates filter expressions with eval(), and attackers escape the sandbox via re.search __globals__ to execute Python code in the scheduler…
CVE-2026-110015 is a CSRF flaw (CWE-352, CVSS 8.8) in the Salon Booking System WordPress plugin before 10.31.9. The plugin discards WordPress core's nonce check for cookie-authenticated REST API requests, letting unauthenticated attackers forge requests…
Erupt through 2.3.0 is vulnerable to HQL injection (CWE-564) via the linkTreeVal parameter of POST /erupt-api/data/table/{erupt}, letting authenticated users bypass tree-scoped data filters and read data from other mapped entities. CVSS 3.1 score 5.3…
CVE-2026-94134 is an insecure-by-default flaw in the Apache Airflow SSH provider hook: unless host_key is configured or no_host_key_check is explicitly set to false, SSH and SFTP connections accept any server key, letting a machine-in-the-middle…
Events Made Easy for WordPress (through 3.2.22) allows unauthenticated stored XSS via the event[location_name] parameter, but only when guest submission and forced location creation are both enabled; fixed in 3.2.23, CVSS 5.4.
Missing capability check in The Squeeze WordPress plugin before 1.8.1 lets any authenticated user, including Subscribers, revert any attachment to its backup and permanently delete the backup and generated WebP derivatives, regardless of ownership.…
CVE-2026-110703 is a stored cross-site scripting flaw in the GeoDirectory WordPress plugin (all versions up to and including 2.8.191), exploitable via the post_content parameter by authenticated subscriber-level users who own a published listing; because…
Stored Cross-Site Scripting (CWE-79) in the WP Sessions Time Monitoring Full Automatic WordPress plugin, all versions up to and including 1.1.5, exploitable by unauthenticated attackers via the action, function, plugin, post_type, post_status, ids, loggedout,…