| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions. |
| Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions. |
| Contributor Local File Inclusion in Vino <= 1.9 versions. |
| Unauthenticated Broken Access Control in Photography <= 7.7.6 versions. |
| Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions. |
| Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions. |
| Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions. |
| Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions. |
| Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions. |
| Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12. |
| Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions. |
| The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses. An attacker who could place an indirect prompt injection in content processed by Codex, such as a connected-tool result or another untrusted source, could induce the model to construct a remote image URL containing sensitive data. The app automatically fetched that URL when rendering the response, sending the embedded data to an attacker-controlled server without a separate user click. Successful exploitation could exfiltrate secrets and other information accessible in the Codex session, including API keys, source code, and data returned by connected tools. No direct integrity or availability impact was demonstrated, and there is no known exploitation in the wild. |
| Unauthenticated Cross Site Request Forgery (CSRF) in WP Activity Log <= 5.6.4 versions. |
| Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions. |
| Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions. |
| Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions. |
| AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $() and backticks. Attackers can inject arbitrary OS commands through the Live plugin on_publish.php endpoint despite escapeshellarg() protection. |
| A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multi_uploadify.php. Performing a manipulation of the argument Filedata[] results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may be used. |
| Subscriber Broken Access Control in ListingPro <= 2.9.10 versions. |
| A vulnerability was found in kronosnet's (version <=1.34) cryptographic configuration management. The framework does not correctly zero-out or wipe sensitive memory segments after executing changes to its cryptographic configuration. This omission leaves raw encryption keys resident in memory after the associated structures are freed. A local attacker capable of leveraging memory disclosure techniques could exploit this flaw to retrieve the active encryption key, allowing them to decrypt cluster network communications or inject malicious packets to cause severe high-availability cluster instability. |
