Sat, Jun 20 · 02:16 PM CDTCVE-2019-25763
9.8/10 · Must read/watchNVDvuln
Summary
WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass vulnerability that allows attackers to gain unauthorized access by exploiting the social media login form functionality. Attackers can submit a POST request to the admin-ajax.php endpoint with the uabb-lf-google-submit action, a vali
CVECVE-2019-25763
SeverityCRITICAL
TypeUPDATED
PublishedSat, Jun 20 · 02:16 PM CDT
ModifiedSun, Jun 21 · 01:16 PM CDT
CVE-2020-14967
9.8/10 · Must read/watchNVDvuln
Summary
An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. Its RSA PKCS1 v1.5 decryption implementation does not detect ciphertext modification by prepending '\0' bytes to ciphertexts (it decrypts modified ciphertexts without error). An attacker might prepend these bytes with the goal of triggering mem
CVECVE-2020-14967
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jun 22 · 12:15 PM CDT
ModifiedMon, Jun 22 · 03:18 AM CDT
CVE-2020-14968
9.8/10 · Must read/watchNVDvuln
Summary
An issue was discovered in the jsrsasign package before 8.0.17 for Node.js. Its RSASSA-PSS (RSA-PSS) implementation does not detect signature manipulation/modification by prepending '\0' bytes to a signature (it accepts these modified signatures as valid). An attacker can abuse this behavior in an application by creati
CVECVE-2020-14968
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jun 22 · 12:15 PM CDT
ModifiedMon, Jun 22 · 03:18 AM CDT
CVE-2026-11526
9.8/10 · Must read/watchNVDvuln
Summary
GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle. GD::Image::_make_filehandle opens a filename argument with Perl's 2-arg open(), so a filename that begins or ends with a pipe ("| cmd", "cmd |") or begins with a redirect ("> path
CVECVE-2026-11526
SeverityCRITICAL
TypeUPDATED
PublishedSun, Jun 14 · 12:16 PM CDT
ModifiedSun, Jun 21 · 02:16 PM CDT
CVE-2026-30783
9.8/10 · Must read/watchNVDvuln
Summary
A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Client signaling, API sync loop, config management modules) allows Privilege Abuse. This vulnerability is associated with program files src/rendezvous_mediator.Rs, src/hbbs_http/sync.Rs and program rout
CVECVE-2026-30783
SeverityCRITICAL
TypeUPDATED
PublishedThu, Mar 05 · 04:16 PM CST
ModifiedMon, Jun 22 · 10:16 AM CDT
CVE-2026-30789
9.8/10 · Must read/watchNVDvuln
Summary
Use of Password Hash With Insufficient Computational Effort, Improper Restriction of Excessive Authentication Attempts vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Client login, peer authentication modules) allows Password Brute Forcing. The authentication pro
CVECVE-2026-30789
SeverityCRITICAL
TypeUPDATED
PublishedThu, Mar 05 · 04:16 PM CST
ModifiedMon, Jun 22 · 10:16 AM CDT
CVE-2026-30790
9.8/10 · Must read/watchNVDvuln
Summary
Use of Password Hash With Insufficient Computational Effort, Cleartext Transmission of Sensitive Information vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Server Pro /api login over the HTTP management channel) allows Interception (aka Sniffing) followed by off
CVECVE-2026-30790
SeverityCRITICAL
TypeUPDATED
PublishedThu, Mar 05 · 04:16 PM CST
ModifiedMon, Jun 22 · 10:16 AM CDT
CVE-2026-56265
9.8/10 · Must read/watchNVDvuln
Summary
Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing authentication and gaining full access to protected functionality.
CVECVE-2026-56265
SeverityCRITICAL
TypeNEW
PublishedSun, Jun 21 · 02:16 PM CDT
ModifiedSun, Jun 21 · 02:16 PM CDT
CVE-2026-56395
9.6/10 · Must read/watchNVDvuln
Summary
SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or
CVECVE-2026-56395
SeverityCRITICAL
TypeNEW
PublishedSun, Jun 21 · 02:16 PM CDT
ModifiedSun, Jun 21 · 02:16 PM CDT
CVE-2026-56397
9.6/10 · Must read/watchNVDvuln
Summary
SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Attackers can achieve remote code execution on any user browsing the Bazaar by embedding XSS payloads in package displayName, description, or
CVECVE-2026-56397
SeverityCRITICAL
TypeNEW
PublishedSun, Jun 21 · 02:16 PM CDT
ModifiedSun, Jun 21 · 02:16 PM CDT
CVE-2021-30246
9.1/10 · Must read/watchNVDvuln
Summary
In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.
CVECVE-2021-30246
SeverityCRITICAL
TypeUPDATED
PublishedWed, Apr 07 · 09:15 PM CDT
ModifiedMon, Jun 22 · 03:18 AM CDT
CVE-2026-4599
9.1/10 · Must read/watchNVDvuln
Summary
Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recover the private key by exploiting the incorrect compareTo checks that accep
CVECVE-2026-4599
SeverityCRITICAL
TypeUPDATED
PublishedMon, Mar 23 · 06:16 AM CDT
ModifiedMon, Jun 22 · 03:18 AM CDT
CVE-2026-8450
9.1/10 · Must read/watchNVDvuln
Summary
HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> path' open the path for write or append. Untrusted input pass
CVECVE-2026-8450
SeverityCRITICAL
TypeUPDATED
PublishedWed, May 27 · 05:16 AM CDT
ModifiedMon, Jun 22 · 10:16 AM CDT
CVE-2026-12806
8.8/10 · Worth your timeNVDvuln
Summary
A vulnerability has been found in Edimax BR-6478AC V2 1.23. The impacted element is the function formWlSiteSurvey of the file /goform/formWlSiteSurvey of the component POST Request Handler. The manipulation of the argument selSSID leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has
CVECVE-2026-12806
SeverityHIGH
TypeNEW
PublishedSun, Jun 21 · 08:16 PM CDT
ModifiedSun, Jun 21 · 08:16 PM CDT
CVE-2026-56396
8.8/10 · Worth your timeNVDvuln
Summary
phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that allow authenticated administrators to escalate privileges. Non-SuperAdmin users with edit_user permission can set is_superadmin flag or grant arbitrary rights to escalate to SuperAdmin access.
CVECVE-2026-56396
SeverityHIGH
TypeNEW
PublishedSun, Jun 21 · 02:16 PM CDT
ModifiedSun, Jun 21 · 02:16 PM CDT
CVE-2026-4601
8.7/10 · Worth your timeNVDvuln
Summary
Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without retrying, and then s
CVECVE-2026-4601
SeverityHIGH
TypeUPDATED
PublishedMon, Mar 23 · 06:16 AM CDT
ModifiedMon, Jun 22 · 03:18 AM CDT
CVE-2023-45796
8.1/10 · Worth your timeNVDvuln
Summary
A stored cross-site scripting vulnerability in the Runtime component of Pilz PASvisu before 1.14.1 and PMI v8xx up to and including 2.0.33992 allows a low-privileged remote unauthenticated attacker to manipulate process data with potential impact on integrity and/or availability.
CVECVE-2023-45796
SeverityHIGH
TypeNEW
PublishedMon, Jun 22 · 10:16 AM CDT
ModifiedMon, Jun 22 · 10:16 AM CDT
CVE-2025-71348
8.1/10 · Worth your timeNVDvuln
Summary
picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but executes during pickle.load, enabling remote code execution in supply chain attacks.
CVECVE-2025-71348
SeverityHIGH
TypeNEW
PublishedSun, Jun 21 · 02:16 PM CDT
ModifiedSun, Jun 21 · 02:16 PM CDT
CVE-2025-71357
8.1/10 · Worth your timeNVDvuln
Summary
picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.
CVECVE-2025-71357
SeverityHIGH
TypeNEW
PublishedSun, Jun 21 · 02:16 PM CDT
ModifiedSun, Jun 21 · 02:16 PM CDT
CVE-2025-71378
8.1/10 · Worth your timeNVDvuln
Summary
picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypass picklescan detection and execute remote code when loaded via pickle.load().
CVECVE-2025-71378
SeverityHIGH
TypeNEW
PublishedSun, Jun 21 · 02:16 PM CDT
ModifiedSun, Jun 21 · 02:16 PM CDT
CVE-2026-30792
8.1/10 · Worth your timeNVDvuln
Summary
A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Strategy sync, HTTP API client, config options engine modules) allows Application API Message Manipulation via Man-in-the-Middle. This vulnerability is associated with program files src/hbbs_http/sync.R
CVECVE-2026-30792
SeverityHIGH
TypeUPDATED
PublishedThu, Mar 05 · 04:16 PM CST
ModifiedMon, Jun 22 · 10:16 AM CDT
CVE-2026-30794
8.1/10 · Worth your timeNVDvuln
Summary
Improper Certificate Validation vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (HTTP API client, TLS transport modules) allows Adversary in the Middle (AiTM). This vulnerability is associated with program files src/hbbs_http/http_client.Rs and program routines TL
CVECVE-2026-30794
SeverityHIGH
TypeUPDATED
PublishedThu, Mar 05 · 04:16 PM CST
ModifiedMon, Jun 22 · 10:16 AM CDT
CVE-2023-45795
7.8/10 · Worth your timeNVDvuln
Summary
A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before 1.14.1 allows a local unauthenticated attacker to inject malicious javascript and gain full control over the device.
CVECVE-2023-45795
SeverityHIGH
TypeNEW
PublishedMon, Jun 22 · 10:16 AM CDT
ModifiedMon, Jun 22 · 10:16 AM CDT
CVE-2026-10118
7.8/10 · Worth your timeNVDvuln
Summary
A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write.
CVECVE-2026-10118
SeverityHIGH
TypeUPDATED
PublishedMon, Jun 01 · 05:16 PM CDT
ModifiedMon, Jun 22 · 08:16 AM CDT
CVE-2026-50256
7.8/10 · Worth your timeNVDvuln
Summary
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1
CVECVE-2026-50256
SeverityHIGH
TypeUPDATED
PublishedFri, Jun 05 · 12:16 PM CDT
ModifiedMon, Jun 22 · 08:17 AM CDT
