CVE-2026-126662 - Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Filemount Bypass via Edit-Multiple
CVE ID :CVE-2026-126662
Published : Nov. 11, 2026, 1:17 p.m. | 1 hour, 14 minutes ago
Description :Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or syncExclude field permission can submit outside folder paths in the IDS parameter to publish protected folders or exclude them from DBAFS synchronization, exposing files for public download.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-126662
Published : Nov. 11, 2026, 1:17 p.m. | 1 hour, 14 minutes ago
Description :Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains an access control bypass vulnerability that allows filemount-restricted backend users to modify folders outside their filemount via the file manager Edit-Multiple operation. Attackers holding the protected or syncExclude field permission can submit outside folder paths in the IDS parameter to publish protected folders or exclude them from DBAFS synchronization, exposing files for public download.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-126663 - Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Path Traversal via Image Insert Tag
CVE ID :CVE-2026-126663
Published : Nov. 11, 2026, 1:17 p.m. | 1 hour, 14 minutes ago
Description :Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains a path traversal vulnerability that allows content editors to read image files anywhere on the filesystem via the {{image::}} insert tag. Attackers can embed percent-encoded sequences like ..%2f that pass Validator::isInsecurePath() before rawurldecode(), making the frontend resize and serve readable image files outside the files directory.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-126663
Published : Nov. 11, 2026, 1:17 p.m. | 1 hour, 14 minutes ago
Description :Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 contains a path traversal vulnerability that allows content editors to read image files anywhere on the filesystem via the {{image::}} insert tag. Attackers can embed percent-encoded sequences like ..%2f that pass Validator::isInsecurePath() before rawurldecode(), making the frontend resize and serve readable image files outside the files directory.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-94125 - Apache Storm: Supervisor page discloses worker placement of other users' topologies
CVE ID :CVE-2026-94125
Published : Nov. 11, 2026, 1:17 p.m. | 1 hour, 14 minutes ago
Description :Nimbus returns the worker placement of every topology running on a supervisor, including the host, port, owner and resource assignment of topologies the caller is not authorized to read. In a multi-tenant cluster, an authenticated user who is allowed to access Nimbus can learn where the workers of other users' topologies run. Users are recommended to upgrade to version 3.2.0, which fixes the issue.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-94125
Published : Nov. 11, 2026, 1:17 p.m. | 1 hour, 14 minutes ago
Description :Nimbus returns the worker placement of every topology running on a supervisor, including the host, port, owner and resource assignment of topologies the caller is not authorized to read. In a multi-tenant cluster, an authenticated user who is allowed to access Nimbus can learn where the workers of other users' topologies run. Users are recommended to upgrade to version 3.2.0, which fixes the issue.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-0470 - AMD Embedded SPI Flash Driver Null Pointer Dereference
CVE ID :CVE-2026-0470
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Null pointer dereference in AMD Embedded SPI Flash driver could allow a local user to potentially cause a loss of availability.
Severity: 6.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-0470
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Null pointer dereference in AMD Embedded SPI Flash driver could allow a local user to potentially cause a loss of availability.
Severity: 6.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-123040 - TrueConf Server Linux Privilege Escalation Vulnerability
CVE ID :CVE-2026-123040
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :An attacker who gains the ability to execute arbitrary code on a system with TrueConf Server (Linux) versions from 4.7.2 up to, but not including, 5.5.6 installed, running as the user trueconf (by exploiting some other vulnerability), can elevate their privileges to root.
Severity: 8.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-123040
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :An attacker who gains the ability to execute arbitrary code on a system with TrueConf Server (Linux) versions from 4.7.2 up to, but not including, 5.5.6 installed, running as the user trueconf (by exploiting some other vulnerability), can elevate their privileges to root.
Severity: 8.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
😁1
CVE-2026-125838 - WordPress Quality theme <= 3.3 - Cross Site Request Forgery (CSRF) vulnerability
CVE ID :CVE-2026-125838
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Cross-Site Request Forgery (CSRF) vulnerability in webriti Quality quality allows Cross Site Request Forgery.This issue affects Quality: from n/a through 3.3.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-125838
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Cross-Site Request Forgery (CSRF) vulnerability in webriti Quality quality allows Cross Site Request Forgery.This issue affects Quality: from n/a through 3.3.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-125839 - WordPress ElitePress theme <= 3.2.1 - Cross Site Request Forgery (CSRF) vulnerability
CVE ID :CVE-2026-125839
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Cross-Site Request Forgery (CSRF) vulnerability in webriti ElitePress elitepress allows Cross Site Request Forgery.This issue affects ElitePress: from n/a through 3.2.1.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-125839
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Cross-Site Request Forgery (CSRF) vulnerability in webriti ElitePress elitepress allows Cross Site Request Forgery.This issue affects ElitePress: from n/a through 3.2.1.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-125840 - WordPress Rambo theme <= 3.0 - Cross Site Request Forgery (CSRF) vulnerability
CVE ID :CVE-2026-125840
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Cross-Site Request Forgery (CSRF) vulnerability in webriti Rambo rambo allows Cross Site Request Forgery.This issue affects Rambo: from n/a through 3.0.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-125840
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Cross-Site Request Forgery (CSRF) vulnerability in webriti Rambo rambo allows Cross Site Request Forgery.This issue affects Rambo: from n/a through 3.0.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-125841 - WordPress Heroic theme <= 1.4.2 - Cross Site Request Forgery (CSRF) vulnerability
CVE ID :CVE-2026-125841
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Cross-Site Request Forgery (CSRF) vulnerability in webriti Heroic heroic allows Cross Site Request Forgery.This issue affects Heroic: from n/a through 1.4.2.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-125841
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Cross-Site Request Forgery (CSRF) vulnerability in webriti Heroic heroic allows Cross Site Request Forgery.This issue affects Heroic: from n/a through 1.4.2.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-125842 - WordPress Wallstreet Agency theme <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability
CVE ID :CVE-2026-125842
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Cross-Site Request Forgery (CSRF) vulnerability in webriti Wallstreet Agency wallstreet-agency allows Cross Site Request Forgery.This issue affects Wallstreet Agency: from n/a through 1.3.4.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-125842
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Cross-Site Request Forgery (CSRF) vulnerability in webriti Wallstreet Agency wallstreet-agency allows Cross Site Request Forgery.This issue affects Wallstreet Agency: from n/a through 1.3.4.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-125843 - WordPress Spasalon theme <= 3.0 - Cross Site Request Forgery (CSRF) vulnerability
CVE ID :CVE-2026-125843
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Cross-Site Request Forgery (CSRF) vulnerability in webriti Spasalon spasalon allows Cross Site Request Forgery.This issue affects Spasalon: from n/a through 3.0.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-125843
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Cross-Site Request Forgery (CSRF) vulnerability in webriti Spasalon spasalon allows Cross Site Request Forgery.This issue affects Spasalon: from n/a through 3.0.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-125844 - WordPress vice theme <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability
CVE ID :CVE-2026-125844
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Cross-Site Request Forgery (CSRF) vulnerability in webriti vice vice allows Cross Site Request Forgery.This issue affects vice: from n/a through 1.4.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-125844
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Cross-Site Request Forgery (CSRF) vulnerability in webriti vice vice allows Cross Site Request Forgery.This issue affects vice: from n/a through 1.4.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-125845 - WordPress vdequator theme <= 1.2.7 - Cross Site Request Forgery (CSRF) vulnerability
CVE ID :CVE-2026-125845
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Cross-Site Request Forgery (CSRF) vulnerability in webriti vdequator vdequator allows Cross Site Request Forgery.This issue affects vdequator: from n/a through 1.2.7.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-125845
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Cross-Site Request Forgery (CSRF) vulnerability in webriti vdequator vdequator allows Cross Site Request Forgery.This issue affects vdequator: from n/a through 1.2.7.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-125846 - WordPress Mazino theme <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability
CVE ID :CVE-2026-125846
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Cross-Site Request Forgery (CSRF) vulnerability in webriti Mazino mazino allows Cross Site Request Forgery.This issue affects Mazino: from n/a through 1.1.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-125846
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Cross-Site Request Forgery (CSRF) vulnerability in webriti Mazino mazino allows Cross Site Request Forgery.This issue affects Mazino: from n/a through 1.1.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-125847 - WordPress vdperanto theme <= 2.2 - Cross Site Request Forgery (CSRF) vulnerability
CVE ID :CVE-2026-125847
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Cross-Site Request Forgery (CSRF) vulnerability in webriti vdperanto vdperanto allows Cross Site Request Forgery.This issue affects vdperanto: from n/a through 2.2.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-125847
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Cross-Site Request Forgery (CSRF) vulnerability in webriti vdperanto vdperanto allows Cross Site Request Forgery.This issue affects vdperanto: from n/a through 2.2.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-125848 - WordPress Leo theme <= 1.7.4 - Cross Site Request Forgery (CSRF) vulnerability
CVE ID :CVE-2026-125848
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Cross-Site Request Forgery (CSRF) vulnerability in webriti Leo leo allows Cross Site Request Forgery.This issue affects Leo: from n/a through 1.7.4.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-125848
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Cross-Site Request Forgery (CSRF) vulnerability in webriti Leo leo allows Cross Site Request Forgery.This issue affects Leo: from n/a through 1.7.4.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-125849 - WordPress Shk Corporate theme <= 2.4.3 - Cross Site Request Forgery (CSRF) vulnerability
CVE ID :CVE-2026-125849
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Cross-Site Request Forgery (CSRF) vulnerability in webriti Shk Corporate shk-corporate allows Cross Site Request Forgery.This issue affects Shk Corporate: from n/a through 2.4.3.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-125849
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Cross-Site Request Forgery (CSRF) vulnerability in webriti Shk Corporate shk-corporate allows Cross Site Request Forgery.This issue affects Shk Corporate: from n/a through 2.4.3.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-125850 - WordPress Appointment Dark theme <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability
CVE ID :CVE-2026-125850
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Cross-Site Request Forgery (CSRF) vulnerability in webriti Appointment Dark appointment-dark allows Cross Site Request Forgery.This issue affects Appointment Dark: from n/a through 1.3.4.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-125850
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Cross-Site Request Forgery (CSRF) vulnerability in webriti Appointment Dark appointment-dark allows Cross Site Request Forgery.This issue affects Appointment Dark: from n/a through 1.3.4.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-40853 - Apache XML Graphics Batik: Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont
CVE ID :CVE-2026-40853
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :A Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-40853
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :A Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-48479 - AMD Graphics Driver Out-of-Bounds Write Vulnerability
CVE ID :CVE-2026-48479
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Use of uninitialized or invalid state in AMD Graphics Driver could allow a local attacker to write out of bounds, potentially resulting in loss of integrity or denial of service.
Severity: 6.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-48479
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Use of uninitialized or invalid state in AMD Graphics Driver could allow a local attacker to write out of bounds, potentially resulting in loss of integrity or denial of service.
Severity: 6.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-49236 - Apache XML Graphics Batik: SVG color-profile xml:base bypasses Batik external resource same-origin checks
CVE ID :CVE-2026-49236
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik. SVG color-profile xml:base bypasses Batik external resource same-origin checks This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-49236
Published : Nov. 11, 2026, 2:17 p.m. | 14 minutes ago
Description :Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik. SVG color-profile xml:base bypasses Batik external resource same-origin checks This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...