CVE Vulnerability Catalog

A vulnerability in the System REST API allows authenticated users with publisher privileges to upload files to arbitrary server-accessible locations due to insufficient validation of file type and destination. This could lead to code execution.

Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109. A remote attacker could exploit a crafted HTML page to potentially perform a sandbox escape.

Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109. A remote attacker could exploit a crafted HTML page to potentially perform a sandbox escape.

Use after free in Web Authentication in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Insufficient validation of untrusted input in Codecs in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Out of bounds write in ANGLE in Google Chrome on Android prior to 151.0.7922.109. A remote attacker could potentially perform a sandbox escape via a crafted HTML page.

Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109. A remote attacker could potentially perform a sandbox escape via a crafted HTML page.

A privilege escalation vulnerability in Sophos Endpoint for macOS (before 2026.1.1) and Sophos Home for macOS (before 10.11.6) allows local users to execute arbitrary code as root.

Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites.

A Server-Side Template Injection (SSTI) vulnerability in WGDashboard version 4.3.2 and earlier allows authenticated attackers to execute arbitrary code as root.

A Remote Code Execution (RCE) vulnerability exists in WGDashboard version 4.2.3 and earlier. Multiple OS command injection allows authenticated attackers to execute arbitrary commands as root.

A Server-Side Request Forgery (SSRF) vulnerability exists in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses.

The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injection, giving an unauthenticated attacker full control of the affected site.

The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) and the version MonsterInsights rolled back to (10.2.0) contain a malicious file, `class-system-check.php`. Three distinct variants were observed on 2026-06-11, all sharing the same AES-256-GCM key, confirming a single threat actor. The attacker retains write access to the S3 bucket and has been actively iterating on the payload throughout the day.

In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could exploit this to execute arbitrary OS commands with root privileges on the underlying operating system. Exploitation may lead to a complete system takeover.

The CTX Feed plugin versions up to 6.6.42 contain a Remote Code Execution (RCE) vulnerability exploitable by a shop manager. An attacker with shop manager privileges can execute arbitrary code on the server.

The Type Hub plugin versions up to 2.0.6 contain an Unauthenticated Arbitrary File Upload vulnerability. A remote unauthenticated attacker can upload malicious files to the server.

The Frontend Admin by DynamiApps plugin versions up to 3.29.10 contain an Unauthenticated Privilege Escalation vulnerability. A remote unauthenticated attacker can escalate privileges in the system.