CVE Notifier

CVE-2026-93987 CWE-73 3.4

rclone serve docker Path Traversal via Volume Name

rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin. newVolume() in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Join(drv.root,…

cve.org rclone:rclone 4 jam lalu

CVE-2026-93986 CWE-22 3.1

rclone before 1.75.1 Path Traversal via Directory Listing Names

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward s…

cve.org rclone:rclone 4 jam lalu

CVE-2026-93985 CWE-94 9.9

OpenPanel js-runtime JavaScript Template Sandbox Escape RCE

OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project w…

cve.org Openpanel-dev:openpanel 4 jam lalu

CVE-2026-93984 CWE-287 5.3

OpenPanel API Authentication Bypass via Unverified Client Secret

OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID …

cve.org Openpanel-dev:openpanel 4 jam lalu

CVE-2026-93983 CWE-89 5.0

OpenPanel SQL Injection via ClickHouse Property Key Filter

OpenPanel through commit bad75bdd fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation a…

cve.org Openpanel-dev:openpanel 4 jam lalu

CVE-2026-93982 CWE-532 3.3

OpenPanel MCP Authentication Token in Query Parameter Logged Plaintext

OpenPanel through commit bad75bdd writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized …

cve.org Openpanel-dev:openpanel 4 jam lalu

CVE-2026-93981 CWE-79 4.7

hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provid…

cve.org honojs:hono 4 jam lalu

CVE-2026-78030 CWE-470 N/A

DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM

DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. DBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the…

cve.org 5 jam lalu

CVE-2026-93742 CWE-77 9.9

Totolink A3002MU formWsc command injection

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. Affected by this issue is the function formWsc of the file /boafrm/formWsc. This manipulation of the argument localPin causes command injection. The a…

cve.org Totolink:A3002MU 7 jam lalu

CVE-2026-9858 CWE-862 4.3

Partial Shipment for Woocommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX Actions

The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.4 via the wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX a…

cve.org wpexpertshub:Partial · Shipment · for 7 jam lalu

CVE-2026-9613 CWE-862 4.3

Datalogics Ecommerce Delivery <= 2.6.65 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics_create_shipping / datalogics_cancel_shipping)

The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not properly verifying that a user is auth…

cve.org datalogics:Datalogics · Ecommerce · Delivery 7 jam lalu

CVE-2026-76579 CWE-79 4.7

LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This …

cve.org litespeedtech:LiteSpeed · Cache 7 jam lalu