CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11...
CVE-2014-125130
CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contains an unauthenticate
#severity:high
共收录 5417 条相关情报。
← 返回所有主题Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL
### Summary A project member can create a webhook alert channel whose delivery URL points at an internal address, and tr
Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)
### Summary The dashboard replay action authorizes the source run (it must belong to the caller's org), but the target e
Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths
### Affected files * `dulwich/index.py` (Methods: `validate_path_element_ntfs`, `_tree_to_fs_path`) * `dulwich/porcelain
Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections
## Summary Dulwich's `porcelain.checkout(paths=[...])` code path writes files using raw `os.open(file_path, O_WRONLY|O_
Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence
## Summary Dulwich's `filter_branch.py` `CommitFilter._apply_index_filter()` is vulnerable to symlink directory travers
Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks
## Summary Dulwich's `stash.py:pop()` function is vulnerable to symlink directory traversal, allowing an attacker to wr
Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache...
CVE-2026-102795
Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows...
CVE-2026-96613
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to a
An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create...
CVE-2026-102626
An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScri
TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in...
CVE-2026-51916
TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in super
In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal...
CVE-2026-51907
In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows at
An API key is hardcoded and retrievable from the application package. Since Android applications...
CVE-2026-103097
An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineer
Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is...
CVE-2026-103098
Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather th
API key is hardcoded and retrievable from the application package. Since Android applications can...
CVE-2026-103096
API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered,
Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP...
CVE-2026-103765
Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata hand
Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows...
CVE-2025-71427
Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and
Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that...
CVE-2026-103760
Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated rem
Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in...
CVE-2026-103761
Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePee
ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows...
CVE-2026-103766
ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with ad_manager