CVE Explorer

Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-54900

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, when in usual mode with create_id enabled, Oj::Parser#parse is vulnerable to heap corruption via a negative-size memcpy. When a JSON object key is exactly 65,535 bytes long, an integer truncation in form_attr (usual.c:63) converts the length to -1 before passing it to memcpy. This causes memcpy to copy SIZE_MAX bytes (interpreted as a huge size_t), corrupting heap memory and crashing t

PUBLISHED

Vendor: ohler55
Product: oj
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-5490

DriveLock SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of DriveLock. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 4568 by default. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privil

PUBLISHED

Vendor: DriveLock
Product: DriveLock
Provider severity: HIGH
Conflicts: 0

CVE-2026-54899

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, disabling symbol_keys on a reused Oj::Parser instance triggers a heap use-after-free. When symbol_keys is toggled from true to false, opt_symbol_keys_set frees the internal key cache (cache_free) but does not clear the pointer. The next parse call reads from the freed cache via cache_intern, producing a use-after-free. This issue has been fixed in version 3.17.2.

PUBLISHED

Vendor: ohler55
Product: oj
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-54898

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2,Oj::Parser#parse is vulnerable to a heap use-after-free when a SAJ/SAJ2 callback mutates the input JSON string during parsing. The C engine holds a raw const byte * pointer into the Ruby string's internal buffer. If a callback (e.g. hash_start) resizes the string — for example by calling String#replace with a longer value — Ruby reallocates the string buffer and frees the old one. The C

PUBLISHED

Vendor: ohler55
Product: oj
Provider severity: LOW
Conflicts: 0

CVE-2026-54897

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to 3.17.2, Oj::Doc iterators (each_value, each_child, each_leaf) were vulnerable to a heap use-after-free. When a Ruby block yielded during iteration calls doc.close or d.close, the document's heap memory is freed while the C iterator is still running. When control returns from the block, the iterator reads from the freed region, producing a use-after-free accessible from pure Ruby. This issue has been fixed

PUBLISHED

Vendor: ohler55
Product: oj
Provider severity: LOW
Conflicts: 0

CVE-2026-54896

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, when in object mode, Oj.dump is vulnerable to a heap buffer overflow when serializing Exception objects with a large :indent value. The serializer allocates a buffer sized for the object's attributes but does not account for the indent bytes added on each write. With indent: 5000, the accumulation of 5,000-byte indent strings overflows the 13,150-byte heap allocation, corrupting adjace

PUBLISHED

Vendor: ohler55
Product: oj
Provider severity: LOW
Conflicts: 0

CVE-2026-54894

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :"guardian_<input>", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other

PUBLISHED

Vendor: ueberauth, ueberauth
Product: guardian, guardian
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-54893

URL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path (/users/{from}/sendMail) without percent-encoding or validation. In applications that derive the from address from untrusted or user-influenced input (for example a relay, a contact form, or a "send as" feature), an attacker can place URL-special characters such as /, ?, or # in the local part of the address

PUBLISHED

Vendor: swoosh, swoosh
Product: swoosh, swoosh
Provider severity: LOW
Conflicts: 1

CVE-2026-54892

Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to cause denial of service. Plug.Conn.Query.decode/4 (and Plug.Conn.Query.decode_each/2) parse query strings and application/x-www-form-urlencoded request bodies. When a key contains many bracketed segments such as a[a][a][a]=1, the decoder walks the brackets and, for each of the N levels, performs a map operation keyed on an ever-growing binary prefix of the key, hashing the full byte

PUBLISHED

Vendor: elixir-plug, elixir-plug
Product: plug, plug
Provider severity: HIGH
Conflicts: 1

CVE-2026-54891

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl (tls_gen_connection module) allows a network-positioned attacker to inject unauthenticated plaintext that the TLS client application later treats as authenticated server data. The function tls_gen_connection:handle_protocol_record/3 rejects APPLICATION_DATA records that arrive in pre-handshake states when the TLS endpoint acts as a server, but does not apply the same check wh

PUBLISHED

Vendor: Erlang, Erlang, Erlang
Product: OTP, OTP, OTP
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-54890

Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c. The BIT_BINARY_EXT tag (77) handler in the External Term Format (ETF) decoder accepts an encoding with both length and trailing-bits fields set to zero. The subsequent computation of the bitstring size underflow

PUBLISHED

Vendor: Erlang, Erlang
Product: OTP, OTP
Provider severity: HIGH
Conflicts: 2

CVE-2026-5489

DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 4568 by default. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability t

PUBLISHED

Vendor: DriveLock
Product: DriveLock
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-54889

Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in leandrocp mdex allows cross-site scripting via unsanitized URL schemes in Quill Delta output. 'Elixir.MDEx':to_delta/2 converts Markdown into a Quill Delta. 'Elixir.MDEx.DeltaConverter':default_convert_node/3 in lib/mdex/delta_converter.ex copies the URL of a link, wikilink, or image node directly from the parsed Markdown into the Delta "link" or "image" attribute without applying a scheme allowlist or any normal

PUBLISHED

Vendor: leandrocp, leandrocp
Product: mdex, mdex
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-54888

Uncontrolled Recursion vulnerability in leandrocp mdex allows denial of service via deeply nested Markdown input. mdex converts between an Elixir %MDEx.Document{} struct and Comrak's internal AST using two mutually recursive Rust functions, ex_document_to_comrak_ast and comrak_ast_to_ex_document, in the NIF source file document.rs. Neither function enforces a maximum nesting depth, so the recursion depth is bounded only by the structure of the input. An attacker who can get a Markdown document

PUBLISHED

Vendor: leandrocp, leandrocp, leandrocp, leandrocp
Product: mdex_native, mdex_native, mdex, mdex
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-54887

Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass. On DTLS server startup, dtls_server_connection:initial_hello/3 initializes previous_cookie_secret to the empty binary (<<>>) instead of a random value. Because HMAC with an empty key is deterministic, anyone who observes the plaintext ClientHello can compute dtls_handshake:cookie(<<>>, IP, Port, Hello) a

PUBLISHED

Vendor: Erlang, Erlang
Product: OTP, OTP
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-54886

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to render an SFTP channel permanently unresponsive. The handle_data/4 function in ssh_sftpd contains a catch-all clause that accepts channel data of any type. When channel data with a non-zero type code (SSH_MSG_CHANNEL_EXTENDED_DATA) arrives with an empty pending buffer and a payload at or below the SFTP packet size limit, the clause tail-calls itself with

PUBLISHED

Vendor: Erlang, Erlang
Product: OTP, OTP
Provider severity: MEDIUM
Conflicts: 2

CVE-2026-54885

Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints. Three code paths fetch remote URIs supplied by the requester without sufficient validation of the target. Boruta.Oauth.Request.Base.fetch_unsigned_request/1 in lib/boruta/oauth/request/base.ex dereferences the OAuth request_uri param

PUBLISHED

Vendor: malach-it, malach-it
Product: boruta, boruta
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-5488

The ExactMetrics – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 9.1.2. This is due to missing capability checks in the get_ads_access_token() and reset_experience() AJAX handlers. While the mi-admin-nonce is localized on all admin pages (including profile.php which subscribers can access), and while other similar AJAX endpoints in the same class properly check for the exactmetrics_save_settings capability, th

PUBLISHED

Vendor: smub
Product: ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-5487

PUBLISHED

Vendor: DriveLock
Product: DriveLock
Provider severity: HIGH
Conflicts: 0

CVE-2026-5486

The Unlimited Elements for Elementor plugin for WordPress is vulnerable to SQL Injection via the 'data[filter_search]' parameter in the get_cat_addons AJAX action in versions up to and including 2.0.7. This is due to insufficient input sanitization and the use of deprecated escaping functions combined with direct string concatenation in SQL query construction. The vulnerability is exacerbated because the normalizeAjaxInputData() function calls stripslashes() on all user input, removing the prote

PUBLISHED

Vendor: unitecms
Product: Unlimited Elements For Elementor
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-5485

OS command injection in the browser-based authentication component in Amazon Athena ODBC driver before 2.0.5.1 on Linux might allow a threat actor to execute arbitrary code by using specially crafted connection parameters that are loaded by the driver during a local user-initiated connection. To remediate this issue, users should upgrade to version 2.0.5.1 or later.

PUBLISHED

Vendor: Amazon
Product: Amazon Athena ODBC driver
Provider severity: HIGH
Conflicts: 1

CVE-2026-54849

Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions.

PUBLISHED

Vendor: Premmerce
Product: Premmerce Wishlist for WooCommerce
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-54848

Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts Square for WooCommerce allows Retrieve Embedded Sensitive Data. This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.3.

PUBLISHED

Vendor: Saad Iqbal
Product: APIExperts Square for WooCommerce
Provider severity: HIGH
Conflicts: 0

CVE-2026-54847

Unauthenticated Broken Access Control in Stylish Cost Calculator <= 8.3.9 versions.

PUBLISHED

Vendor: Design
Product: Stylish Cost Calculator
Provider severity: HIGH
Conflicts: 0

CVE-2026-54846

Unauthenticated Broken Access Control in Syncee Premium Dropshipping & Wholesale <= 1.0.27 versions.

PUBLISHED

Vendor: akosglys
Product: Syncee Premium Dropshipping & Wholesale
Provider severity: HIGH
Conflicts: 0

CVE-2026-54845

Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions.

PUBLISHED

Vendor: PluginUs.Net
Product: MDTF
Provider severity: HIGH
Conflicts: 0

CVE-2026-54844

Unauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 versions.

PUBLISHED

Vendor: CheckView
Product: CheckView Automated Testing
Provider severity: HIGH
Conflicts: 0

CVE-2026-54843

Unauthenticated SQL Injection in MDTF <= 1.3.7 versions.

PUBLISHED

Vendor: PluginUs.Net
Product: MDTF
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-54842

Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal MCP: from n/a through 1.4.25.

PUBLISHED

Vendor: Royal Plugins
Product: Royal MCP
Provider severity: HIGH
Conflicts: 0

CVE-2026-54841

Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions.

PUBLISHED

Vendor: Appsbd
Product: Vitepos
Provider severity: HIGH
Conflicts: 0

CVE-2026-54840

Unauthenticated Broken Access Control in Newsletters <= 4.13 versions.

PUBLISHED

Vendor: Tribulant Software
Product: Newsletters
Provider severity: HIGH
Conflicts: 0

CVE-2026-5484

A weakness has been identified in BookStackApp BookStack up to 26.03. Affected is the function chapterToMarkdown of the file app/Exports/ExportFormatter.php of the component Chapter Export Handler. Executing a manipulation of the argument pages can lead to improper access controls. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 26.03.1 is able to address this issue. This patch is called 8a59895ba

PUBLISHED

Vendor: BookStackApp
Product: BookStack
Provider severity: MEDIUM
Conflicts: 2

CVE-2026-54839

Unauthenticated Sensitive Data Exposure in Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups <= 2.0.9 versions.

PUBLISHED

Vendor: kingaddons
Product: Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups
Provider severity: HIGH
Conflicts: 0

CVE-2026-54838

Subscriber SQL Injection in WC Vendors Marketplace <= 2.6.8 versions.

PUBLISHED

Vendor: Rymera Web Co
Product: WC Vendors Marketplace
Provider severity: HIGH
Conflicts: 0

CVE-2026-54837

Unauthenticated Broken Access Control in Intranet & Private Site – All-In-One Intranet <= 1.8.1 versions.

PUBLISHED

Vendor: Syed Balkhi
Product: Intranet & Private Site – All-In-One Intranet
Provider severity: HIGH
Conflicts: 0

CVE-2026-54836

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YMC Filter allows SQL Injection. This issue affects YMC Filter: from n/a through 3.11.5.

PUBLISHED

Vendor: YMC
Product: YMC Filter
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-54835

Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions.

PUBLISHED

Vendor: Rustaurius
Product: Five Star Restaurant Menu
Provider severity: HIGH
Conflicts: 0

CVE-2026-54834

Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 versions.

PUBLISHED

Vendor: fpuenteonline
Product: Object Cache 4 everyone
Provider severity: HIGH
Conflicts: 0

CVE-2026-54833

Unauthenticated Backdoor in Enable CORS <= 2.0.3 versions.

PUBLISHED

Vendor: Dev Kabir
Product: Enable CORS
Provider severity: HIGH
Conflicts: 0

CVE-2026-54832

Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions.

PUBLISHED

Vendor: Jegstudio
Product: Gutenverse Companion
Provider severity: HIGH
Conflicts: 0

CVE-2026-54831

Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions.

PUBLISHED

Vendor: Paolo
Product: GeoDirectory
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-54830

Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions.

PUBLISHED

Vendor: Etoile Web Design Incorporated
Product: Five Star Restaurant Reservations
Provider severity: HIGH
Conflicts: 0

CVE-2026-5483

A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` component of Red Hat OpenShift AI (RHOAI) allows for the disclosure of Kubernetes Service Account tokens through a NodeJS endpoint. This could enable an attacker to gain unauthorized access to Kubernetes resources.

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat OpenShift AI 3.2, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI 2.16, Red Hat OpenShift AI 3.3, Red Hat OpenShift AI 3.2, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI 2.16, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI 3.3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 2.25
Provider severity: HIGH
Conflicts: 1

CVE-2026-54829

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jacob N. Breetvelt WP Photo Album Plus allows Blind SQL Injection. This issue affects WP Photo Album Plus: from n/a through 9.1.13.005.

PUBLISHED