TP2WP Importer <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Watched domains' Textarea

readymadeweb TP2WP Importer

WP Social Meta <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings

bulktheme WP Social Meta

WP Responsive Images <= 1.0 - Unauthenticated Path Traversal to Arbitrary File Read via src

stuartbates WP Responsive Images

EM Cost Calculator <= 2.3.1 - Unauthenticated Stored Cross-Site Scripting via 'customer_name'

motahar1 EM Cost Calculator

fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

NaturalIntelligence fast-xml-parser fast-xml-parser_project fast-xml-parser +1个

OpenLIT Vulnerable to Remote Code Execution and Secret Exposure via Misuse of `pull_request_target` in GitHub Actions Workflows

openlit openlit

WPGraphQL Repo Vulnerable to Command Injection via Unsanitized GitHub Actions Expression in Release Workflow

wp-graphql wp-graphql

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

isaacs minimatch isaacs minimatch +7个

minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

isaacs minimatch isaacs minimatch +7个

Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers

sveltejs svelte svelte svelte

Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`

sveltejs svelte svelte svelte +1个

Spin has memory leaks in various WIT interfaces

spinframework spin spinframework SpinKube +1个

Terraform Provider Debug Logs Vulnerable to Sensitive Information Exposure

linode terraform-provider-linode

sealed-secrets /v1/rotate can widen sealing scope to cluster-wide via attacker-controlled template annotations

Bitnami sealed-secrets

WireGuard Portal Vulnerable to Privilege Escalation to Admin via User Self-Update

h44z wg-portal wgportal wireguard_portal

MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity

modelcontextprotocol go-sdk

c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

swaldman c3p0

pypdf: Manipulated FlateDecode XFA streams can exhaust RAM

py-pdf pypdf pypdf_project pypdf

NetExec vulnerable to arbitrary file write via path traversal in spider_plus module

Pennyw0rth NetExec

Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize

withastro astro