The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.1...

CVE-2026-92084

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shor

历史摘要 · 未重新核验 · NVD

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing ...

CVE-2026-103519

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, an

历史摘要 · 未重新核验 · NVD

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing ...

CVE-2026-100157

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, an

历史摘要 · 未重新核验 · NVD

The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO,...

CVE-2026-100152

The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugi

历史摘要 · 未重新核验 · GitHub Advisory

The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to arbitrary shortcode exec...

CVE-2026-100152

The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugi

历史摘要 · 未重新核验 · NVD

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Informa...

CVE-2026-92536

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePres

历史摘要 · 未重新核验 · NVD

Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF

### Summary: 5 findings — `BashTool` shell-injection sink (F6, the canonical RCE primitive), `BackgroundRunTool` async

历史摘要 · 未重新核验 · GitHub Advisory

fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluate...

CVE-2026-104851

fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fssp

历史摘要 · 未重新核验 · NVD

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without...

CVE-2026-104849

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-s

历史摘要 · 未重新核验 · NVD

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

CVE-2026-104851

fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fssp

历史摘要 · 未重新核验 · OSV.dev

Tinypool: Prototype Pollution Gadget to RCE in run() options

CVE-2026-104849

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-s

历史摘要 · 未重新核验 · OSV.dev

A vulnerability was found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file script/academic/core/new_announcement.php of the compo...

CVE-2026-104612

A vulnerability was found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the fi

历史摘要 · 未重新核验 · NVD

The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insufficient input validation on the 'Feed Con...

CVE-2026-10026

The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This

历史摘要 · 未重新核验 · NVD

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/valida...

CVE-2026-55251

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to

历史摘要 · 未重新核验 · NVD

NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files

CVE-2026-55251

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to

历史摘要 · 未重新核验 · OSV.dev

A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution (RCE) by bypassing the safemode sandbox within the templating...

CVE-2026-96658

A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution (RCE

历史摘要 · 未重新核验 · NVD

vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection

CVE-2026-92937

## Summary Untrusted JavaScript run by vm2 can escape the sandbox and execute arbitrary commands in the host Node.js pr

历史摘要 · 未重新核验 · GitHub Advisory

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

CVE-2026-102830

## Description A language pack ships a `Plural-Forms` header saying how the language counts, for example `nplurals=2; p

历史摘要 · 未重新核验 · GitHub Advisory

A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validat...

CVE-2026-103686

A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of t

历史摘要 · 未重新核验 · NVD

rhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scripting

CVE-2026-103686

A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of t

历史摘要 · 未重新核验 · OSV.dev