551 articles
CVE-2022-50966 (CVSS 6.1): uBidAuction 2.0.1 reflected XSS in the news/manage module allows remote attackers to inject scripts via unsanitized GET parameters date_created,...
CVE-2022-50945 (CVSS 6.4): Stored XSS in WordPress 3dady real-time web stats plugin 1.0 lets authenticated attackers inject JavaScript via unsanitized input fields, enabling...
CVE-2022-50955: WordPress Curtain 1.0.2 CSRF flaw lets attackers trick admins into toggling site maintenance mode via forged requests without nonce validation.
CVE-2021-47948 (CVSS 5.4): Authenticated attackers can inject arbitrary HTML via the Help Text field in GetPaid 2.4.6, enabling stored XSS attacks on payment forms.
CVE-2026-8069: Acer PredatorSense versions 3.00.3136 to 3.00.3196 expose a misconfigured named pipe, letting any authenticated local user execute code as SYSTEM and delete...
CVE-2026-42880 (CVSS 9.6) in Argo CD lets read-only attackers extract plaintext Kubernetes Secrets via ServerSideDiff endpoint using Server-Side Apply dry-run.
CVE-2026-8149 in Bouncy Castle BC-FJA 2.1.0–2.1.2 leaks AES-GCM authentication keys via side-channel in AVX-512f optimized gcm128w/gcm512w routines.
CVE-2026-8076: CashDro 3 ATM admin panel (v24.01.00.26) accepts numeric PINs for authentication, enabling brute-force attacks that can compromise cash dispenser controls.
CVE-2023-47268 (CVSS 5.3): A crafted 3mf project file in PrusaSlicer through 2.6.1 executes arbitrary code when sliced — no user interaction beyond opening the file.
CVE-2024-30167 (CVSS 6.3): Authenticated users can execute arbitrary commands as root on Atlona AT-OME-MS42 Matrix Switcher 1.1.2 via a crafted POST to /cgi-bin/time.cgi.
CVE-2025-69690 (CVSS 9.1) lets authenticated admins achieve remote code execution on pfSense CE 2.7.2 by crafting a backup file with a serialized PHP object.
CVE-2025-69691 (CVSS 9.9) in Netgate pfSense CE 2.8.0 lets authenticated admins execute arbitrary PHP via XMLRPC's pfsense.exec_php; Netgate disputes the severity.
