| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| slide-maker through 5.8.0 contains a path traversal vulnerability in generate_images_openai.py that allows attackers to write image files outside the output directory via manifest-supplied filenames. Attackers can influence deck source material so the image prompt manifest contains ../ or symlinked filenames, creating directories and overwriting existing files at arbitrary paths. |
| Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolve or DNS-rebind to loopback or internal addresses, causing blind POST requests to internal HTTPS services. |
| Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Request Forgery.
This issue affects Builderius: from 1.4 through 1.4-beta. |
| Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service.
Decimal.round/3 builds the full result for the requested number of decimal places before the context precision (34 digits by default) is applied, so its cost grows with the places argument instead of with the size of the result. For positive places it appends places zero digits to the coefficient as a charlist before converting it to an integer, and for negative places it builds a charlist of -places zero digits. A single call such as Decimal.round(Decimal.new("1.5"), -50_000_000) allocates about 5.5 GB of memory, which can exhaust available memory and get the BEAM VM killed. The oldest releases instead loop once per decimal place, consuming CPU in proportion to places.
Any application that passes a user-supplied number of decimal places or scale to Decimal.round/2 or Decimal.round/3 without bounding it is exposed. The input limits added for CVE-2026-32686 do not cover the places argument.
This issue affects decimal: from 0.1.0 before 3.1.2. |
| Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data.
This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0. |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS.
This issue affects Kids Planet: from n/a through 2.2.14.2. |
| Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions. |
| Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions. |
| Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions. |
| Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions. |
| Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions. |
| Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions. |
| Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions. |
| Unauthenticated PHP Object Injection in Alliance <= 3.11 versions. |
| Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions. |
| Unauthenticated PHP Object Injection in Original <= 1.9.0 versions. |
| Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions. |
| Unauthenticated Local File Inclusion in Ambient <= 1.7 versions. |
| Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions. |
| Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions. |
