OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files

CVE-2026-54706

### Summary OnionShare CLI/Desktop 2.6.3 can follow symbolic links inside a selected Share or Website directory and serv

历史摘要 · 未重新核验 · GitHub Advisory

OnionShare Receive mode writes uploaded files even when file uploads are disabled

CVE-2026-54707

### Summary OnionShare CLI/Desktop 2.6.3 does not enforce the Receive mode `disable_files` setting at the file upload si

历史摘要 · 未重新核验 · GitHub Advisory

Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

CVE-2026-52857

### Summary Config file parsers, `json`, `yaml`, `xml` etc in parser.go have no file size limit/checks, allowing for a g

历史摘要 · 未重新核验 · GitHub Advisory

@dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification

### Summary A template injection vulnerability in the `create_workflow_for_notification` tool lets a caller embed Jinja2

历史摘要 · 未重新核验 · GitHub Advisory

The Improved Save Button plugin for WordPress is vulnerable to second-order SQL Injection via ...

CVE-2026-16092

The Improved Save Button plugin for WordPress is vulnerable to second-order SQL Injection via 'meta_key' Custom Field vi

历史摘要 · 未重新核验 · GitHub Advisory

The Persian Elementor (المنتور فارسی) plugin for WordPress is vulnerable to Price Manipulation in...

CVE-2026-1982

The Persian Elementor (المنتور فارسی) plugin for WordPress is vulnerable to Price Manipulation in all versions up to, an

历史摘要 · 未重新核验 · GitHub Advisory

mathlive's Lack of Escaping of HTML allows for XSS

CVE-2026-54705

### Summary Despite the 0.104.0 patch escaping attribute-bearing constructs (`\htmlData`, `\href`), text-content reflec

历史摘要 · 未重新核验 · GitHub Advisory

OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords

CVE-2026-54704

OpenTelemetry Java Instrumentation JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements wh

历史摘要 · 未重新核验 · GitHub Advisory

OpenTelemetry Javaagent RMI context propagation allows resource exhaustion

CVE-2026-54712

The RMI context propagation payload reader limits the number of context entries but does not limit the aggregate size of

历史摘要 · 未重新核验 · GitHub Advisory

Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page

CVE-2026-52837

## Summary The booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::inde

历史摘要 · 未重新核验 · GitHub Advisory

olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193

### Problem Multiple vulnerabilities were disclosed in 2024 affecting libolm (Olm): AES timing / side‑channel, Ed25519

历史摘要 · 未重新核验 · GitHub Advisory

Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

CVE-2026-50558

### Summary Penelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating a

历史摘要 · 未重新核验 · GitHub Advisory

Req vulnerable to multipart form-data header injection via unescaped name/filename/content_type

CVE-2026-49756

### Summary Req's multipart form encoder interpolates the per-part `name`, `filename`, and `content_type` directly into

历史摘要 · 未重新核验 · GitHub Advisory

veraPDF Parser DoS via PostScript Type 1 Font Programs

CVE-2026-54081

## Summary **Description** A PostScript-interpreter-driven Denial of Service (CWE-1325) vulnerability in veraPDF allow

历史摘要 · 未重新核验 · GitHub Advisory

veraPDF Parser DoS via PostScript CMap Streams

CVE-2026-54080

## Summary **Description** A PostScript-interpreter-driven Denial of Service (CWE-1325) vulnerability in veraPDF allow

历史摘要 · 未重新核验 · GitHub Advisory

veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs

CVE-2026-54082

### Summary veraPDF-validation has an XML External Entity (XXE) vulnerability in two PDF parsing paths (validate and `G

历史摘要 · 未重新核验 · GitHub Advisory

The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable...

CVE-2026-17162

The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Sc

历史摘要 · 未重新核验 · GitHub Advisory

The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event...

CVE-2026-17166

The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress

历史摘要 · 未重新核验 · GitHub Advisory

The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable...

CVE-2026-17161

The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Sc

历史摘要 · 未重新核验 · GitHub Advisory

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ...

CVE-2026-12939

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the p

历史摘要 · 未重新核验 · GitHub Advisory