آخرین آسیب‌پذیری‌ها

Unvalidated parent-supplied AWS Region in AWS aws-nitro-enclaves-sdk-c allows impersonation of the enclave's AWS KMS endpoint

Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management cluster

WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability

WordPress Media Player Addons for Elementor – Media Player widget for WP plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability

Use-after-free in the SetClient command handler of kmstool-enclave in AWS aws-nitro-enclaves-sdk-c

WordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerability

DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation

zuke setup and zuke import follow symbolic links planted at scaffold names, allowing writes outside the target directory

Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run

Cluster identity takeover in Fleet cluster registration allows access to another cluster's Fleet namespace

Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gate

Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line

Zuke: Command-form registry descriptors bypass the MCP launch policy

Stored XSS via crafted URLs in HTML ticket content in Request Tracker

Stored XSS via related ticket subject on RTIR Split and Create Incident forms

WordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerability

Stored XSS via HTML scrubber rule in RTIR

Blender before 4.5.15 and 5.x before 5.2.3 Heap Out-of-Bounds Access via read_struct()

Blender before 4.5.15 and 5.x before 5.2.3 Out-of-Bounds Read via blo_bhead_id Accessors

Blender before 4.5.15 and 5.x before 5.2.3 Out-of-Bounds Read via GLOB Block

Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Thumbnail Extraction

Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Point Cache

pybars3 through 0.9.7 and pybars4 through 0.9.13 Code Injection via Bracketed Path Segments

NocoDB before 2026.08.0 Clickjacking via Missing Frame-Control Headers

My Calendar 3.8.8 before 3.8.11 Unauthenticated Shortcode Injection via mcs Parameter