Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.
CVE-2026-39759
Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.
2026-10-07 归档
今日共收录 1979 条安全情报，包含 1214 个 CVE，387 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.
CVE-2026-39757
Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.
Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions.
CVE-2026-39755
Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions.
Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions.
CVE-2026-39753
Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions.
Unauthenticated SQL Injection in Booknetic <= 4.8.5 versions.
CVE-2026-39746
Unauthenticated SQL Injection in Booknetic <= 4.8.5 versions.
Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions.
CVE-2026-32579
Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions.
Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions.
CVE-2026-32568
Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions.
Unauthenticated SQL Injection in WooCommerce Appointments <= 5.3.2 versions.
CVE-2026-32557
Unauthenticated SQL Injection in WooCommerce Appointments <= 5.3.2 versions.
An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.
CVE-2026-94293
An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read a
A vulnerability has been found in Tenda AC5 02.03.01.111_multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of the component Wifi Handler. S...
CVE-2026-105778
A vulnerability has been found in Tenda AC5 02.03.01.111_multi. Affected by this issue is some unknown functionality of
A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the ...
CVE-2026-105484
A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the functio
There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service endpoi...
CVE-2026-82989
There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticat
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the ser...
CVE-2026-105740
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflo
Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an ...
CVE-2026-105697
Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio tra
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask comm...
CVE-2026-105691
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlle
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Ma...
CVE-2026-97283
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager al
FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). This vulnerability allows attackers to a...
CVE-2026-88424
FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.Ge
Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check,...
CVE-2026-105639
Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for an
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is conf...
CVE-2026-104711
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') v
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events...
CVE-2026-103352
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Bo