Explore CVE records

MedPublished 27 May 2026, 22:12 WIB

CVE-2026-49054

WordPress The Post Grid plugin <= 7.9.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Mamunur Rashid The Post Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Post Grid: from n/a through 7.9.2.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 00:49 WIB

Official record

MedPublished 27 May 2026, 22:10 WIB

CVE-2026-44353

Streamlink: Arbitrary local file read via file:// URI in HLS and DASH

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.4.0, Streamlink's HLS and DASH parsers do not validate the URI scheme of segment entries and other resources. A remote .m3u8 HLS playlist or .mpd DASH manifest can list file:///path/to/file as a segment, and stre…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

HighPublished 27 May 2026, 22:09 WIB

CVE-2026-42790

nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification

Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification. Two flaws combine to allow a subordinate CA whose DNS nameConstraints are restricted (e.g. permitted;DNS:allowed.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated18 Sep 2026, 19:04 WIB

Official record

MedPublished 27 May 2026, 22:07 WIB

CVE-2026-44839

RabbitMQ: Unsanitized vhost names allow for XSS in management UI

RabbitMQ is a messaging and streaming broker. From 3.7.0 to before 4.1.2 and 4.0.13, This vulnerability is fixed in 4.1.2 and 4.0.13.

Excerpt language: en.

CVSS5.6v4.0KEVNot listedEPSSPresentUpdated27 May 2026, 22:47 WIB

Official record

MedPublished 27 May 2026, 22:03 WIB

CVE-2026-44838

RabbitMQ MQTT Topic Permission Authorization Bypass

RabbitMQ is a messaging and streaming broker. From 4.2.0 to before 4.2.4, RabbitMQ's MQTT plugin allows for topic-level authorization using regular expressions with variable substitution. Administrators can create patterns such as ^{client_id}-sensors$ to restrict user access to topics that include their client ID. How…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 May 2026, 21:31 WIB

Official record

HighPublished 27 May 2026, 21:59 WIB

CVE-2026-48545

Gradio < 6.15.0 Cookie Injection via Shared Proxy Client

Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Space session fixation by exploiting a shared module-level HTTP client used across all users in the reverse proxy endpoint. Attackers controlling any HF Space can return a parent-domain cookie that the s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:22 WIB

Official record

LowPublished 27 May 2026, 21:59 WIB

CVE-2026-45570

go-git: Improper single-quote escaping in go-git SSH transport

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. A repository path containing a single quote can th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated28 May 2026, 22:12 WIB

Official record

MedPublished 27 May 2026, 21:58 WIB

CVE-2026-49053

WordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Wpmet ElementsKit Elementor addons Lite allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ElementsKit Elementor addons Lite: from n/a through 3.9.6.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 22:28 WIB

Official record

MedPublished 27 May 2026, 21:57 WIB

CVE-2026-45571

go-git: Crafted repositories may modify main and submodule .git directories

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validation issue in go-git could allow crafted repository data to affect files outside the intended checkout target, including the repository's .git directory. These validations were introduced in upstream G…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 23:03 WIB

Official record

MedPublished 27 May 2026, 21:55 WIB

CVE-2026-49052

WordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access Control vulnerability

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 23:05 WIB

Official record

HighPublished 27 May 2026, 21:54 WIB

CVE-2026-45022

go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or tag objects contain ambiguous or malformed headers, go-git’s decoded representation may expose values differently from …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7v4.0KEVNot listedEPSSPresentUpdated27 May 2026, 22:43 WIB

Official record

MedPublished 27 May 2026, 21:53 WIB

CVE-2026-49051

WordPress WP Meta and Date Remover plugin <= 2.3.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Prasad Kirpekar WP Meta and Date Remover allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Meta and Date Remover: from n/a through 2.3.6.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 22:34 WIB

Official record

MedPublished 27 May 2026, 21:51 WIB

CVE-2026-49047

WordPress DearFlip plugin <= 2.4.27 - Broken Access Control vulnerability

Missing Authorization vulnerability in DearHive DearFlip allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects DearFlip: from n/a through 2.4.27.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 00:48 WIB

Official record

HighPublished 27 May 2026, 21:49 WIB

CVE-2026-49046

WordPress Duplicate Page and Post plugin <= 2.9.5 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arjun Thakur Duplicate Page and Post allows Blind SQL Injection. This issue affects Duplicate Page and Post: from n/a through 2.9.5.

Excerpt language: en.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 22:25 WIB

Official record

HighPublished 27 May 2026, 21:49 WIB

CVE-2026-44902

opentelemetry-js: Prometheus exporter process crash via malformed HTTP request

opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaug…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 22:26 WIB

Official record

MedPublished 27 May 2026, 21:46 WIB

CVE-2026-49044

WordPress Advanced Custom Fields: Font Awesome Field plugin <= 5.0.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Kruit Advanced Custom Fields: Font Awesome Field allows Stored XSS. This issue affects Advanced Custom Fields: Font Awesome Field: from n/a through 5.0.2.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 23:07 WIB

Official record

MedPublished 27 May 2026, 21:44 WIB

CVE-2026-49045

WordPress Adminimize plugin <= 1.11.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Media Adminimize allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Adminimize: from n/a through 1.11.11.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 22:31 WIB

Official record

HighPublished 27 May 2026, 21:43 WIB

CVE-2026-44971

GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration

GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, the programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an attacker who can influenc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 23:09 WIB

Official record

MedPublished 27 May 2026, 21:42 WIB

CVE-2026-44972

GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content

GuardDog is a CLI tool to identify malicious PyPI packages. From 2.6.0 to 2.9.0, GuardDog includes attacker-controlled filenames, file locations, messages, and code snippets in its default human-readable output without escaping terminal control characters. A malicious package can therefore inject ANSI or OSC escape seq…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 22:34 WIB

Official record

HighPublished 27 May 2026, 21:39 WIB

CVE-2026-42280

Improper Permission Checking in Auth.js SDK

Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. This vulnerability is fixed in 10.0.0.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 22:36 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage