CVE ID :CVE-2026-56397 Published : June 21, 2026, 1:27 p.m. | 5 hours, 43 minutes ago Description :SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript.…
CVE ID :CVE-2026-56395 Published : June 21, 2026, 1:27 p.m. | 5 hours, 43 minutes ago Description :SiYuan before v3.6.1 fails to sanitize package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript.…
CVE ID :CVE-2026-56396 Published : June 21, 2026, 1:27 p.m. | 5 hours, 43 minutes ago Description :phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that allow authenticated administrators to escalate privileges. Non-SuperAdmin users with edit_user permission can…
CVE ID :CVE-2026-56382 Published : June 21, 2026, 1:26 p.m. | 5 hours, 43 minutes ago Description :Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCardPreview() method, which passes the fieldLayoutConfig…
CVE ID :CVE-2026-56265 Published : June 21, 2026, 1:26 p.m. | 5 hours, 43 minutes ago Description :Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the…
CVE ID :CVE-2026-56345 Published : June 20, 2026, 6:27 p.m. | 34 minutes ago Description :AVideo through 29.0 contains an authorization bypass vulnerability in the Meet plugin’s uploadRecordedVideo.json.php endpoint that derives the target users_id from the uploaded filename without verification. An…
CVE ID :CVE-2026-56340 Published : June 20, 2026, 6:27 p.m. | 34 minutes ago Description :vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default, an…
CVE ID :CVE-2026-56341 Published : June 20, 2026, 6:27 p.m. | 34 minutes ago Description :AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records. Unauthenticated attackers…
CVE ID :CVE-2024-58351 Published : June 20, 2026, 3:21 p.m. | 3 hours, 39 minutes ago Description :Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the overrideConfig option, supported in both the frontend web integration and…
CVE ID :CVE-2022-50972 Published : June 20, 2026, 1:37 p.m. | 5 hours, 24 minutes ago Description :WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the product-type parameter. Attackers…