CVE Brief Security Intelligence

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Melania allows PHP Local File Inclusion

MariaDB server is a community developed fork of MySQL server

phpTransformer 2016

ArcSearch for Android versions prior to 1

The CMS Commander plugin for WordPress is vulnerable to SQL Injection via the 'or_blogname', 'or_blogdescription', and 'or_admin_email' parameters in all versions up to, and including, 2

The Expire Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1

The 'The Ultimate WordPress Toolkit – WP Extended' plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3

Budibase is a low code platform for creating internal tools, workflows, and admin panels

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java

The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1

The Fonts Manager | Custom Fonts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘fmcfIdSelectedFnt’ parameter in all versions up to, and including, 1

The Quentn WP plugin for WordPress is vulnerable to SQL Injection via the 'qntn_wp_access' cookie in all versions up to, and including, 1

The Linksy Search and Replace plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'linksy_search_and_replace_item_details' function in all versions up to, and including, 1

The myLinksDump plugin for WordPress is vulnerable to SQL Injection via the 'sort_by' and 'sort_order' parameters in all versions up to, and including, 1

The MimeTypes Link Icons plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3

The Invelity Product Feeds plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 1

Cryptomator for Android offers multi-platform transparent client-side encryption for files in the cloud

Cryptomator for IOS offers multi-platform transparent client-side encryption for files in the cloud

A security vulnerability in the Qwik JavaScript framework poses a high risk to web applications, potentially allowing for unauthorized client-side or server-side interactions.

SimpleJWT is a simple JSON web token library written in PHP

A high-severity security vulnerability has been identified in the Natural Language Toolkit (NLTK) Python library, impacting data processing and research environments.

The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3

phpTransformer 2016

ownDMS 4

The Injection Guard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via malicious query parameter names in all versions up to and including 1

The WowOptin: Next-Gen Popup Maker plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1

The Performance Monitor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1

The SurveyJS plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2

The Vagaro Booking Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘vagaro_code’ parameter in all versions up to, and including, 0

The Content Syndication Toolkit plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1

Cross-Site request forgery (CSRF) vulnerability in joshuae1974 Flash Video Player allows Cross Site Request Forgery

A vulnerability was identified in PbootCMS up to 3

A vulnerability was detected in projectworlds Online Notes Sharing System 1

Green CMS 2

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing

A vulnerability was identified in D-Link DHP-1320 1

A vulnerability was found in D-Link DIR-513 1

A vulnerability was detected in Tenda A18 Pro 02

A flaw has been found in Tenda A18 Pro 02

A vulnerability has been found in Tenda A18 Pro 02

A vulnerability was found in Tenda A18 Pro 02

A vulnerability was determined in Tenda A18 Pro 02

A flaw has been found in Tenda FH451 1

A vulnerability has been found in Tenda FH451 1

Under certain conditions, an attacker could bind to the same port used by WebCTRL

A high-severity vulnerability has been discovered in Dynaconf, a configuration management tool for Python, which could lead to unauthorized configuration changes.

Kepler Wallpaper Script 1

libfuse is the reference implementation of the Linux FUSE

Stirling-PDF, a locally hosted web application for PDF operations, is affected by a high-severity vulnerability that could lead to unauthorized data access.

A vulnerability was determined in D-Link DIR-820LW 2

A security issue was discovered in the Feast Feature Server's `/read-document` endpoint that allows an unauthenticated remote attacker to read any file accessible to the server process

A vulnerability was determined in trueleaf ApiFlow 0

A vulnerability was determined in UTT HiPER 1200GW up to 2

Precurio Intranet Portal 4

A vulnerability was identified in UTT HiPER 1250GW up to 3

OpenClaw versions 2026

OpenClaw versions prior to 2026

Statamic is a Laravel and Git powered content management system (CMS)

Deserialization of Untrusted Data vulnerability in TotalSuite TotalContest Lite allows Object Injection

Allure 2 is the version 2

FileRise is a self-hosted web file manager / WebDAV server

A high-severity vulnerability has been identified in the Barebox bootloader, potentially allowing for the compromise of the system boot process.

SimplePress CMS 1

i-doit CMDB 1

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations

A high-severity vulnerability in the mcp-memory-service, an open-source memory backend for multi-agent systems, could lead to unauthorized memory access or data leakage.

OneUptime, an observability and management solution, is affected by a high-severity vulnerability that could compromise monitoring data and system availability.

A high-severity vulnerability in ScreenToGif, a popular screen recording tool, could allow for unauthorized code execution on the user's system.

OpenClaw versions prior to 2026

Cryptomator encrypts data being stored on cloud infrastructure

OpenClaw versions prior to 2026

A high-severity vulnerability in the H3 minimal HTTP framework could allow for unauthorized interactions with web services built on the framework.

The WebSocket Application Programming Interface fails to implement rate limiting or restrictions on authentication requests, enabling potential brute-force attacks.

The WebSocket Application Programming Interface lacks necessary restrictions on the frequency of authentication requests, facilitating automated credential attacks.

A security vulnerability has been identified in the SiYuan personal knowledge management system that could allow for unauthorized actions or data access.

The SiYuan personal knowledge management system contains a security flaw that poses a risk to the confidentiality and integrity of stored information.

WebCTRL systems using the BACnet protocol are vulnerable to unauthorized access due to a lack of network-layer authentication inherent in the protocol.

OpenClaw versions prior to 2026

OpenClaw versions prior to 2026

OpenClaw versions prior to 2026

CEWE PHOTO SHOW 6

Lyric Video Creator 2

H3 is a minimal H(TTP) framework

Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications

Filament is a collection of full-stack components for accelerated Laravel development

A vulnerability was determined in Totolink WA300 5

A flaw has been found in eosphoros-ai db-gpt up to 0

GMT is an open source collection of command-line tools for manipulating geographic and Cartesian data sets

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier

A vulnerability was found in Acrel Environmental Monitoring Cloud Platform 1

WeGIA is a web manager for charitable institutions

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras