CVE Explorer

Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-54250

K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names can be written to arbitrary locations on the filesystem when an administrator restores the archive as a compressed etcd snapshot. This vulnerability is fixed in 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1.

PUBLISHED

Vendor: k3s-io
Product: k3s
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-5425

The Widgets for Social Photo Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'feed_data' parameter keys in all versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PUBLISHED

Vendor: trustindex
Product: Widgets for Social Photo Feed
Provider severity: HIGH
Conflicts: 0

CVE-2026-54249

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that submits message history to a Pydantic AI UI adapter (such as the Vercel AI adapter) can reference arbitrary files in the application's model-provider or cloud-storage account. While file URL parts are validated against a scheme allowlist, UploadedFile references — which point to a file by provider file ID or cloud-storage URI (e.g. s3://…

PUBLISHED

Vendor: pydantic, pydantic
Product: pydantic-ai-slim, pydantic-ai
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-54244

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in src/Http/Controllers/CP/PreviewController.php only checked view authorization, but it accepts and renders caller-supplied field values. A Control Panel user with view but not edit permission could therefore submit content they were not authorized to author and generate a shareable Live Preview URL rendering it. This issue is fixed in versi

PUBLISHED

Vendor: statamic
Product: cms
Provider severity: LOW
Conflicts: 0

CVE-2026-54243

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, form submission values in src/Forms/Exporters/CsvExporter.php were not neutralized for spreadsheet formula characters when exported to CSV. A submission containing a value beginning with a formula trigger character, such as =, +, -, or @, could be interpreted as a live formula when a Control Panel user opens the export in a spreadsheet application. Form submissions can come from unauthenticated fr

PUBLISHED

Vendor: statamic
Product: cms
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-54242

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, the Glide image proxy's URL validation in src/Imaging/RemoteUrlValidator.php and src/Imaging/GuzzleAdapter.php could be bypassed using DNS rebinding. The remote hostname was validated as publicly routable, but resolved again when the image was actually fetched, so an attacker controlling the hostname's DNS could rebind it to an internal address after validation and cause the server to make HTTP re

PUBLISHED

Vendor: statamic
Product: cms
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-54236

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, the fix for CVE-2026-22778, which introduced a sanitize_message helper that strips object-repr memory addresses from error messages before they reach the client, is incomplete: several response paths echo str(exc) directly to clients without calling sanitize_message. The unsanitized sites include the Anthropic API router in vllm/entrypoints/anthropic/api_router.py (the POST /v1/messages and POST /v1/mes

PUBLISHED

Vendor: vllm-project
Product: vllm
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-54235

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, ll temperature validation gates use comparison operators (<, >), which silently evaluate to False for NaN and for positive Infinity in Python's IEEE 754 float semantics. Both values pass every guard and propagate to GPU sampling kernels, where they produce undefined behavior or CUDA errors that can crash the inference worker. This vulnerability is fixed in 0.23.1rc0.

PUBLISHED

Vendor: vllm-project
Product: vllm
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-54234

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding workload can cause the rejection sampler to produce a recovered token equal to the model vocabulary size boundary value, which is then converted to negative one when the engine selects the next live token for a request and is written back into the drafter's input ids; that out-of-vocabulary value is later consumed by the model's embedding and

PUBLISHED

Vendor: vllm-project
Product: vllm
Provider severity: HIGH
Conflicts: 1

CVE-2026-54233

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, vLLM's /v1/audio/transcriptions endpoint limits compressed upload size but not decoded PCM output. A 25MB OPUS file expands to ~14.9GB of float32 PCM at decode time. This vulnerability is fixed in 0.23.1rc0.

PUBLISHED

Vendor: vllm-project
Product: vllm
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-54232

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package. The package is installed from a custom index (flashinfer.ai/whl/) using --extra-index-url, but the package name was not registered on PyPI, and UV_INDEX_STRATEGY="unsafe-best-match" is set globally. An attacker who registers flashinfer-jit-cache on PyPI with version 0.6.11.post2 can execute arbitrar

PUBLISHED

Vendor: vllm-project
Product: vllm
Provider severity: HIGH
Conflicts: 0

CVE-2026-54231

A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries matching the crashed process and writes the results to files in the dump directory without sanitizing embedded control characters. A local user can inject arbitrary content into the journal output by embedding newline characters in syslog messages, controlling the content that root writes to dump directory files.

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat
Product: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-54230

A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirections without the O_NOFOLLOW flag. If the target file is replaced with a symlink, the shell process running as root follows the symlink and writes content to the symlink target, allowing arbitrary file overwrites on the system.

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6
Provider severity: HIGH
Conflicts: 1

CVE-2026-54229

A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_READONLY and calls dd_chown to change ownership of all files to the caller's uid, succeeding even while post-create event handlers hold a write lock. This allows an attacker to gain filesystem-level control of the dump directory while privileged event scripts are still running.

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Provider severity: HIGH
Conflicts: 1

CVE-2026-54228

A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package validation and allowing crashes of unpackaged binaries to survive post-create processing.

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Provider severity: HIGH
Conflicts: 1

CVE-2026-54226

A vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 2.6.0 through 2.15.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue.

PUBLISHED

Vendor: Apache Software Foundation
Product: Apache Kvrocks
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-54224

UBB.threads is vulnerable to Denial of Service (DoS). By sending multiple concurrent requests to view any user profile on instances with many registered users, an authenticated attacker can easily exhaust database resources and completely deny access to the application for other users. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 7.7.5 but may also affect other versions.

PUBLISHED

Vendor: UBB Systems
Product: UBB.threads
Provider severity: HIGH
Conflicts: 0

CVE-2026-54223

UBB.threads is vulnerable to Path traversal, allowing attackers with privilege to edit templates to read and write any file on the application’s server that application has privileges to, what results in Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 7.7.5 but may also affect other versions.

PUBLISHED

Vendor: UBB Systems
Product: UBB.threads
Provider severity: HIGH
Conflicts: 0

CVE-2026-54222

UBB.threads is vulnerable to Blind SQL Injection, allowing attackers with access to the Members in Control Panel to interact with the underlying database. Due to insufficient input sanitization, an attacker can extract sensitive information, such as user credentials, by manipulating SQL queries through time-based or boolean-based techniques. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 7.7.5 but may also affect other versions.

PUBLISHED

Vendor: UBB Systems
Product: UBB.threads
Provider severity: HIGH
Conflicts: 0

CVE-2026-54221

UBB.threads is vulnerable to Reflected XSS. The application improperly handles user input in certain requests, enabling attackers to execute arbitrary JavaScript in the context of a victim's browser by tricking them into clicking a crafted link. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 7.7.5 but may also affect other versions.

PUBLISHED

Vendor: UBB Systems
Product: UBB.threads
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-54220

uBB.threads is vulnerable to a Cross-Site Request Forgery (CSRF) due to a lack of protective mechanisms. This allows an attacker to trick an authenticated user into executing unintended actions. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 7.7.5 but may also affect other versions.

PUBLISHED

Vendor: UBB Systems
Product: UBB.threads
Provider severity: HIGH
Conflicts: 0

CVE-2026-5422

A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences

PUBLISHED

Vendor: jupyter
Product: jupyter/jupyter
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-54219

UBB.threads is vulnerable to Stored XSS via user posts and user profile fields. The application fails to properly sanitize user input, allowing low privileged attackers to inject arbitrary JavaScript that executes in a victim's browser upon viewing. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 7.7.5 but may also affect other versions.

PUBLISHED

Vendor: UBB Systems
Product: UBB.threads
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-5420

A security flaw has been discovered in Shinrays Games Goods Triple App up to 1.200. The affected element is an unknown function of the file jRwTX.java of the component cats.goods.sort.sorting.games. Performing a manipulation of the argument AES_IV/AES_PASSWORD results in use of hard-coded cryptographic key . Attacking locally is a requirement. The complexity of an attack is rather high. The exploitability is described as difficult. The exploit has been released to the public and may be used for

PUBLISHED

Vendor: Shinrays Games
Product: Goods Triple App
Provider severity: LOW
Conflicts: 2

CVE-2026-54198

Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.35 versions.

PUBLISHED

Vendor: David Lingren
Product: Media LIbrary Assistant
Provider severity: HIGH
Conflicts: 0

CVE-2026-54197

Unauthenticated Sensitive Data Exposure in GetGenie <= 4.4.1 versions.

PUBLISHED

Vendor: Wpmet
Product: GetGenie
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-54196

Subscriber Privilege Escalation in JetFormBuilder <= 3.6.1 versions.

PUBLISHED

Vendor: Jetmonsters
Product: JetFormBuilder
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-54195

Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions.

PUBLISHED

Vendor: Jetmonsters
Product: JetFormBuilder
Provider severity: HIGH
Conflicts: 0

CVE-2026-54194

Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions.

PUBLISHED

Vendor: ThemeFusion
Product: Fusion Builder
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-54193

Contributor Arbitrary File Deletion in Fusion Builder <= 3.15.4 versions.

PUBLISHED

Vendor: ThemeFusion
Product: Fusion Builder
Provider severity: HIGH
Conflicts: 0

CVE-2026-54192

Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions.

PUBLISHED

Vendor: Ays Pro
Product: Popup box
Provider severity: HIGH
Conflicts: 0

CVE-2026-54191

Unauthenticated Cross Site Scripting (XSS) in Pods <= 3.3.8 versions.

PUBLISHED

Vendor: Pods Framework
Product: Pods
Provider severity: HIGH
Conflicts: 0

CVE-2026-54190

Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions.

PUBLISHED

Vendor: Awesomemotive
Product: Envira Photo Gallery
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-5419

A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 7, Red Hat Update Infrastructure 5, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Update Infrastructure 5, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Hardened Images, Red Hat Enterprise Linux 9, Red Hat Update Infrastructure 5, Red Hat Discovery 2, Red Hat OpenShift Container Platform 4, Red Hat Enterprise Linux 6, Red Hat Update Infrastructure 5, Red Hat Discovery 2
Provider severity: LOW
Conflicts: 1

CVE-2026-54189

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.

PUBLISHED

Vendor: Jetimpex Inc.
Product: JetEngine
Provider severity: HIGH
Conflicts: 0

CVE-2026-54188

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.

PUBLISHED

Vendor: Jetimpex Inc.
Product: JetEngine
Provider severity: HIGH
Conflicts: 0

CVE-2026-54187

Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions.

PUBLISHED

Vendor: Jetimpex Inc.
Product: JetEngine
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-54186

Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions.

PUBLISHED

Vendor: eyecix
Product: JobSearch
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-54185

Subscriber SQL Injection in Cornerstone < 7.8.8 versions.

PUBLISHED

Vendor: THEMECO
Product: Cornerstone
Provider severity: HIGH
Conflicts: 0

CVE-2026-54184

Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions.

PUBLISHED

Vendor: Alberto Hornero
Product: Clean Login
Provider severity: HIGH
Conflicts: 0

CVE-2026-5418

A vulnerability was identified in appsmithorg appsmith up to 1.97. Impacted is the function computeDisallowedHosts of the file app/server/appsmith-interfaces/src/main/java/com/appsmith/util/WebClientUtils.java of the component Dashboard. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.99 is recommended to address this issue. The affected component should be upgraded. The vendo

PUBLISHED

Vendor: appsmithorg
Product: appsmith
Provider severity: HIGH, MEDIUM
Conflicts: 1

CVE-2026-54171

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.

PUBLISHED

Vendor: excon
Product: excon
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-5417

A vulnerability was determined in Dataease SQLbot up to 1.6.0. This issue affects the function get_es_data_by_http of the file backend/apps/db/es_engine.py of the component Elasticsearch Handler. This manipulation of the argument address causes server-side request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.7.0 is capable of addressing this issue. You should upgrade the affected component. The vendor was conta

PUBLISHED

Vendor: Dataease
Product: SQLbot
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-54164

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions prior to 4.1.30, 4.2.26 and 4.3.12, the serializer's AbstractItemNormalizer does not validate the resource type returned when resolving relation IRIs, allowing type confusion where a resource of an unintended type can be silently assigned to a relation property. An attacker who can submit write requests (POST/PUT/PATCH) to an API Platform endpoint with writable relations can supply a relation IRI pointin

PUBLISHED

Vendor: api-platform
Product: core
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-54163

secure_headers manages application of security headers with many safe defaults. Prior to 7.3.0, secure_headers builds the Content-Security-Policy value by stitching directives with ; separators, and build_sandbox_list_directive, build_media_type_list_directive, and build_report_to_directive interpolate caller-supplied strings without scrubbing ;, \r, or \n. When untrusted input reaches SecureHeaders.override_content_security_policy_directives or append APIs for :sandbox, :plugin_types, or :repor

PUBLISHED

Vendor: github
Product: secure_headers
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-5416

Due to the improper neutralization of special elements used in a name parameter a low privileged remote attacker can exploit a command injection vulnerability in the Managed Ethernet Switch, resulting in full system compromise.

PUBLISHED

Vendor: TURCK, TURCK, TURCK
Product: TBEN-LL-SE-M2, TBEN-L4-SE-M2, TBEN-L5-SE-M2
Provider severity: HIGH
Conflicts: 2

CVE-2026-54159

PrestaShop ps_facetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the ps_facetedsearch module rebuilds selected search filters from the request URL, and the value of a slider filter, price or weight, is taken from the URL without sufficient validation and stored in an internal filter-block cache where it is serialized and later read back with a raw native unserialize() in src/Filters/Block.php. By crafting that value, an unauthenticated attacker can smuggle a

PUBLISHED

Vendor: PrestaShop
Product: ps_facetedsearch
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-54158

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the attribute-view (database) cell renderer genAVValueHTML interpolates cell content raw in four of its branches: text, url, phone, and mAsset. A cell value like </textarea><img src=x onerror="..."> or "><img src=x onerror="..."> breaks out of its surrounding tag and runs arbitrary JavaScript in the renderer when the victim opens the block-attribute panel. On Electron desktop the renderer runs with nodeIntegration:tru

PUBLISHED

Vendor: siyuan-note
Product: siyuan
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-54157

LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.57, the /webapi/proxy endpoint on app.lobehub.com accepts a URL in the POST body and fetches it server-side without any authentication. An attacker can use this to make arbitrary outbound requests from LobeHub's infrastructure, leak Vercel deployment details, and inject cookies on the lobehub.com domain through reflected Set-Cookie headers. This vulnerability is fixed in 2.

PUBLISHED

Vendor: lobehub
Product: lobehub
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-5415

The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.38. This is due to the ajax_run_tool() AJAX handler relying solely on a nonce check (check_ajax_referer) for security without performing any capability check, combined with the create_temporary_link tool allowing the generation of passwordless login links for arbitrary users, and the handle_te

PUBLISHED

Vendor: webfactory
Product: Advanced Google reCAPTCHA
Provider severity: HIGH
Conflicts: 0