[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-100689 | 26 Sep 2026 | CVSS 5.9 | gitpython-developers GitPythonGitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodules. While a prior fix… | |
| CVE-2026-100690 | 26 Sep 2026 | CVSS 7.5 | gohugoio hugoHugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to… | |
| CVE-2026-100691 | 26 Sep 2026 | CVSS 5.4 | gohugoio hugoHugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the `lineAnchors`… | |
| CVE-2026-100692 | 26 Sep 2026 | CVSS 7.5 | gohugoio hugoHugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself… | |
| CVE-2026-100680 | 26 Sep 2026 | CVSS 8.1 | budibase serverBudibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated… | |
| CVE-2026-100681 | 26 Sep 2026 | CVSS 5.4 | budibase serverBudibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams… | |
| CVE-2026-100682 | 26 Sep 2026 | CVSS 8.8 | budibase serverBudibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives… | |
| CVE-2026-100683 | 26 Sep 2026 | CVSS 8.0 | budibase serverBudibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating… | |
| CVE-2026-100684 | 26 Sep 2026 | CVSS 8.1 | budibase serverBudibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate, when no… | |
| CVE-2026-100685 | 26 Sep 2026 | CVSS 7.7 | budibase serverBudibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity link… | |
| CVE-2026-100673 | 26 Sep 2026 | CVSS 8.2 | getgrav grav-plugin-datamanagerThe Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view… | |
| CVE-2026-100674 | 26 Sep 2026 | CVSS 4.3 | stoatchatstoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by… | |
| CVE-2026-100675 | 26 Sep 2026 | CVSS 6.5 | stoatchatstoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages… | |
| CVE-2026-100676 | 26 Sep 2026 | CVSS 8.2 | stoatchatJanuary, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version 0.15.5 improperly resolves SVG <image href> values as local… | |
| CVE-2026-100677 | 26 Sep 2026 | CVSS 5.3 | stoatchatstoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses… | |
| CVE-2026-100678 | 26 Sep 2026 | CVSS 6.5 | stoatchatstoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP… | |
| CVE-2026-100679 | 26 Sep 2026 | CVSS 8.8 | stoatchatstoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own… | |
| CVE-2026-100667 | 26 Sep 2026 | CVSS 5.3 | getgrav gravgrav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to be bypassed for content… | |
| CVE-2026-100668 | 26 Sep 2026 | CVSS 6.5 | getgrav gravGrav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The `array` filter (and its identical function form) is on the sandbox allowlist but… | |
| CVE-2026-100669 | 26 Sep 2026 | CVSS 7.5 | getgrav gravGrav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In… | |
| CVE-2026-100670 | 26 Sep 2026 | CVSS 8.8 | getgrav gravGrav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a… | |
| CVE-2026-100671 | 26 Sep 2026 | CVSS 8.0 | getgrav gravGrav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly… | |
| CVE-2026-100672 | 26 Sep 2026 | CVSS 7.5 | getgrav grav-plugin-commentsThe Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON… | |
| CVE-2026-100661 | 26 Sep 2026 | CVSS 7.5 | nettyNetty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK… | |
| CVE-2026-100662 | 26 Sep 2026 | CVSS 7.5 | nettyNetty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption… | |
| CVE-2026-100663 | 26 Sep 2026 | CVSS 7.5 | nettyNetty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form… | |
| CVE-2026-100664 | 26 Sep 2026 | CVSS 7.5 | nettyNetty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the… | |
| CVE-2026-100665 | 26 Sep 2026 | CVSS 7.5 | nettyNetty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when… | |
| CVE-2026-100666 | 26 Sep 2026 | CVSS 7.3 | nettyNetty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final… | |
| CVE-2026-100654 | 26 Sep 2026 | CVSS 6.5 | vllm-project vllmvLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenAI-compatible POST /v1/completions and POST /v1/chat/completions endpoints but… | |
| CVE-2026-100659 | 26 Sep 2026 | CVSS 6.5 | nettyNetty's HTTP/3 codec (io.netty:netty-codec-http3) in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the… | |
| CVE-2026-100660 | 26 Sep 2026 | CVSS 7.5 | nettyNetty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state… | |
| CVE-2026-100647 | 26 Sep 2026 | CVSS 7.5 | vllm-project vllmvLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-compatible and Anthropic API… | |
| CVE-2026-100648 | 26 Sep 2026 | CVSS 5.3 | vllm-project vllmvllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in multimodal chat audio decoding, allowing unauthenticated clients to… | |
| CVE-2026-100649 | 26 Sep 2026 | CVSS 5.3 | vllm-project vllmvLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCodec decoder allocation where sampler subclass shadowing allows… | |
| CVE-2026-100650 | 26 Sep 2026 | CVSS 6.5 | vllm-project vllmvLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the… | Fix |
| CVE-2026-100651 | 26 Sep 2026 | CVSS 6.5 | vllm-project vllmvLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disaggregated serving endpoint /inference/v1/generate. When the request… | |
| CVE-2026-100652 | 26 Sep 2026 | CVSS 7.5 | vllm-project vllmvLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing… | |
| CVE-2026-100653 | 26 Sep 2026 | CVSS 6.5 | vllm-project vllmvLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin… | Fix |
| CVE-2026-100641 | 26 Sep 2026 | CVSS 8.0 | siyuan-note siyuanSiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content… | |
| CVE-2026-100642 | 26 Sep 2026 | CVSS 7.6 | siyuan-note siyuanSiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that… | |
| CVE-2026-100643 | 26 Sep 2026 | CVSS 8.0 | siyuan-note siyuanSiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to… | |
| CVE-2026-100644 | 26 Sep 2026 | CVSS 7.5 | siyuan-note siyuanSiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into… | |
| CVE-2026-100645 | 26 Sep 2026 | CVSS 8.0 | siyuan-note siyuanSiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database renderers where field… | |
| CVE-2026-100646 | 26 Sep 2026 | CVSS 8.1 | siyuan-note siyuanSiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards (CheckAuth in… | |
| CVE-2026-100635 | 26 Sep 2026 | CVSS 5.9 | siyuan-note siyuanSiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or… | |
| CVE-2026-100636 | 26 Sep 2026 | CVSS 7.6 | siyuan-note siyuanSiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoint that allows authenticated administrators to… | |
| CVE-2026-100637 | 26 Sep 2026 | CVSS 7.6 | siyuan-note siyuanSiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write… | |
| CVE-2026-100638 | 26 Sep 2026 | CVSS 7.6 | siyuan-note siyuanSiYuan versions before v3.8.4 contain a path traversal vulnerability in the setNotebookIcon endpoint that allows authenticated administrators to… | |
| CVE-2026-100639 | 26 Sep 2026 | CVSS 8.8 | siyuan-note siyuanSiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutter/button.ts, assigned via… | |
| CVE-2026-100640 | 26 Sep 2026 | CVSS 4.7 | siyuan-note siyuanSiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard… | |
| CVE-2026-100629 | 26 Sep 2026 | CVSS 5.5 | Cap-go capgo.appCapgo (capgo.app backend) before 12.127.5 contains an authorization flaw in the PATCH /private/role_bindings/:binding_id endpoint. The handler… | |
| CVE-2026-100630 | 26 Sep 2026 | CVSS 5.4 | WWBN AVideoAVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick… | |
| CVE-2026-100631 | 26 Sep 2026 | CVSS 7.5 | parse-community parse-serverParse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token… | |
| CVE-2026-100632 | 26 Sep 2026 | CVSS 6.5 | parse-community parse-serverParse Server is an open-source backend server. In versions >= 9.0.0 and < 9.10.1-alpha.8, and in versions < 8.6.89, LiveQuery evaluates the… | |
| CVE-2026-100633 | 26 Sep 2026 | CVSS 6.5 | siyuan-note siyuanSiYuan is a self-hosted personal knowledge management system. In versions 3.8.0 through 3.8.3, the MCP file tool's sensitive-path guard… | |
| CVE-2026-100634 | 26 Sep 2026 | CVSS 4.7 | siyuan-note siyuanSiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process… | |
| CVE-2026-100621 | 26 Sep 2026 | CVSS 4.3 | Cap-go capgo.appCapgo (capgo.app) contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the time of… | |
| CVE-2026-100622 | 26 Sep 2026 | CVSS 7.5 | Cap-go capgo.appcapgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthenticated… | |
| CVE-2026-100623 | 26 Sep 2026 | CVSS 8.8 | Cap-go capgo.appCapgo (capgo.app) exposes the legacy membership table public.org_users directly through Supabase PostgREST. The table's row-level security policies… | |
| CVE-2026-100624 | 26 Sep 2026 | CVSS 5.4 | Cap-go capgo.appCapgo.app before 12.264.5 does not enforce upload expiry or build lifecycle state in the /build/upload/:jobId TUS proxy endpoint. When a native build… | |
| CVE-2026-100625 | 26 Sep 2026 | CVSS 7.1 | Cap-go capgo.appCapgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that authorizes a caller against a… | |
| CVE-2026-100626 | 26 Sep 2026 | CVSS 4.3 | Cap-go capgo.appcapgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled… | |
| CVE-2026-100627 | 26 Sep 2026 | CVSS 8.1 | Cap-go capgo.appCapgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT… | |
| CVE-2026-100628 | 26 Sep 2026 | CVSS 4.3 | Cap-go capgo.appcapgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apikey… | |
| CVE-2026-100614 | 26 Sep 2026 | CVSS 8.8 | Cap-go capgo.appCapgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable… | |
| CVE-2026-100615 | 26 Sep 2026 | CVSS 8.8 | Cap-go capgo.appCap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikey_manager to rotate a higher-privileged… | |
| CVE-2026-100616 | 26 Sep 2026 | CVSS 5.5 | Cap-go capgo.appcapgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security UPDATE policy on the… | |
| CVE-2026-100617 | 26 Sep 2026 | CVSS 8.8 | Cap-go capgo.appCap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing authenticated app/org admins… | |
| CVE-2026-100618 | 26 Sep 2026 | CVSS 8.5 | Cap-go capgo.appCapgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled `icon` value… | |
| CVE-2026-100619 | 26 Sep 2026 | CVSS 8.8 | Cap-go capgo.appCapgo (capgo.app) blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be… | |
| CVE-2026-100620 | 26 Sep 2026 | CVSS 3.8 | Cap-go @capgo/cliCapgo CLI (npm package @capgo/cli) through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding… | |
| CVE-2026-100608 | 26 Sep 2026 | CVSS 8.3 | FlowiseAI FlowiseFlowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard enabled and… | |
| CVE-2026-100609 | 26 Sep 2026 | CVSS 6.8 | FlowiseAI FlowiseFlowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user's… | |
| CVE-2026-100610 | 26 Sep 2026 | CVSS 7.5 | FlowiseAI FlowiseFlowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing… | |
| CVE-2026-100611 | 26 Sep 2026 | CVSS 6.5 | Cap-go capgo.appCapgo (capgo.app backend, versions ≤ 12.261.0) improperly restricts which roles the apikey_manager organization role may bind to newly created API… | |
| CVE-2026-100612 | 26 Sep 2026 | CVSS 7.2 | Cap-go capgo.appCapgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table. Migration… | |
| CVE-2026-100613 | 26 Sep 2026 | CVSS 5.3 | Cap-go capgo.appcapgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current release (no patch available at… | |
| CVE-2026-100601 | 26 Sep 2026 | CVSS 5.3 | openclaw clawhubClawHub (openclaw/clawhub) application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching… | |
| CVE-2026-100602 | 26 Sep 2026 | CVSS 6.5 | openclaw clawhubClawHub (openclaw/clawhub application/backend) contains a missing authorization check in the changelog preview feature. A signed-in caller can invoke… | |
| CVE-2026-100603 | 26 Sep 2026 | CVSS 5.4 | openclaw clawhubClawHub (openclaw/clawhub) application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated accounts can… | |
| CVE-2026-100604 | 26 Sep 2026 | CVSS 5.4 | openclaw clawhubClawHub (openclaw/clawhub) contains an incorrect authorization vulnerability in the ClawHub application/backend: an organization-owned skill retains… | |
| CVE-2026-100605 | 26 Sep 2026 | CVSS 7.1 | FlowiseAI FlowiseFlowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys to read and delete chat… | |
| CVE-2026-100606 | 26 Sep 2026 | CVSS 7.7 | FlowiseAI FlowiseFlowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an authentication bypass in the SSO login path. When an SSO callback… | |
| CVE-2026-100607 | 26 Sep 2026 | CVSS 7.7 | FlowiseAI FlowiseFlowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing… | |
| CVE-2026-100600 | 26 Sep 2026 | CVSS 5.3 | openclaw clawhubClawHub (the openclaw/clawhub application/backend) does not bind anonymous HTTP API requests to a trusted caller identity, so all direct anonymous… | |
| CVE-2026-100315 | 26 Sep 2026 | CVSS 7.3 | mathurvishal CloudClassroom-PHP-ProjectA vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown… | |
| CVE-2026-100314 | 26 Sep 2026 | CVSS 7.3 | mathurvishal CloudClassroom-PHP-ProjectA security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an… | |
| CVE-2026-100313 | 26 Sep 2026 | CVSS 4.3 | mathurvishal CloudClassroom-PHP-ProjectA weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown… | |
| CVE-2026-98163 | 26 Sep 2026 | CVSS 7.0 | LinuxIn the Linux kernel, the following vulnerability has been resolved: cgroup: Avoid iteration of dying tasks with zero refcount The commit… | Fix |
| CVE-2026-100312 | 26 Sep 2026 | CVSS 6.3 | mathurvishal CloudClassroom-PHP-ProjectA security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element… | |
| CVE-2026-100311 | 26 Sep 2026 | CVSS 3.5 | mathurvishal CloudClassroom-PHP-ProjectA vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The affected element is an… | |
| CVE-2026-92411 | 26 Sep 2026 | CVSS 6.8 | Unknown WP DeliciousThe WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before… | |
| CVE-2026-96524 | 26 Sep 2026 | CVSS 8.8 | Unknown MCP Server for WordPressThe MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests… | |
| CVE-2026-96525 | 26 Sep 2026 | CVSS 2.7 | Unknown MCP Server for WordPressThe MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create… | |
| CVE-2026-96526 | 26 Sep 2026 | CVSS 2.7 | Unknown MCP Server for WordPressThe MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes… | |
| CVE-2026-96531 | 26 Sep 2026 | CVSS 6.8 | Unknown OptimoleThe Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's… | |
| CVE-2026-96532 | 26 Sep 2026 | CVSS 7.5 | Unknown Testimonials WidgetThe Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial… | |
| CVE-2026-96533 | 26 Sep 2026 | CVSS 5.8 | Unknown Testimonials WidgetThe Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response… | |
| CVE-2026-18143 | 26 Sep 2026 | CVSS 9.8 | Addify Request a Quote for WooCommerceThe Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the… |
Page 149 of 168