better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation...
CVE-2025-71403
better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute
#severity:high
共收录 5411 条相关情报。
← 返回所有主题The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to...
CVE-2026-16144
The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all
The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to...
CVE-2026-16635
The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable...
CVE-2026-15988
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request F
The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is...
CVE-2026-15052
The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cr
The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file...
CVE-2026-15450
The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path trav
The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in...
CVE-2026-15414
The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and incl
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation...
CVE-2026-15006
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vuln
An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This...
CVE-2026-9044
An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an
Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary...
CVE-2026-34641
Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the co
FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files
CVE-2026-54910
### Summary The `subtitlesHandler` endpoint (`GET /api/media/subtitles`) accepts two user-controlled query parameters:
@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag
CVE-2026-53608
### Summary The `@apostrophecms/seo` package injects the Google Analytics Tracking ID (`seoGoogleTrackingId`) and Go
Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers
CVE-2026-53599
## Summary `rex_mediapool::isAllowedExtension` in `redaxo/src/addons/mediapool/lib/mediapool.php` accepts filenames th
Savon::Model evaluates WSDL operation names as Ruby source
CVE-2026-53510
### Impact `Savon::Model` generated SOAP operation methods by interpolating operation names into Ruby source passed to
Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier
CVE-2026-58263
### Summary jodit's built-in `clean-html` sanitizer can be bypassed by a MathML/`` carrier that hides a dangerous elemen
Thumbor has path traversal via post-validation URL decoding bypass in file_loader
CVE-2026-53502
The file_loader performs `unquote()` on the file path AFTER the `abspath() + startswith()` security check. An attacker c
Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS
CVE-2026-53505
### Summary Thumbor's `filters:proportion()` filter does not enforce an upper bound on `` and runs in the post-transform
Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter
CVE-2026-53504
### Summary The regular expression used to parse the `convolution` filter exhibits exponential-time backtracking for cer
Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS
CVE-2026-53503
### Summary Thumbor's `filters:convolution(, , )` filter passes the user-controlled `` value to a C extension (`thumbor/
Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature
CVE-2026-53501
# HMAC validation bypass via multiple `.replace()` calls when removing URL signature ## Summary Thumbor’s HMAC validat