Vulnerabilidades em tigroumeow
33 resultadosAnálise Vexday
A Tigroumeow apresenta um perfil de risco moderado com 17 vulnerabilidades catalogadas, sendo 1 crítica e 3 publicadas nos últimos 90 dias, indicando exposição contínua. Nenhuma vulnerabilidade está sob exploração ativa no momento (KEV), reduzindo a urgência tática imediata. A fraqueza dominante (CWE-434 - Upload Irrestrito de Arquivo) sugere risco de execução de código remoto, exigindo vigilância sobre o padrão de remediação do fornecedor nos próximos trimestres.
CVE-2026-107745MEDIUMAI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' ParameterEPSS 0.3%CVE-2026-9239MEDIUMMeow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute)EPSS 0.3%CVE-2026-107756MEDIUMMeow Lightbox <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_nameEPSS 0.3%CVE-2026-15988HIGHAI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring MatchEPSS 0.3%CVE-2025-8268MEDIUMAi Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And DeletionEPSS 0.3%CVE-2026-110732HIGHAI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client RegistrationEPSS 0.3%CVE-2026-107757MEDIUMGallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment BodyEPSS 0.2%CVE-2026-0746MEDIUMAI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request ForgeryEPSS 0.2%CVE-2026-1291MEDIUMMeow Gallery <= 5.4.4 - Missing Authorization to Authenticated (Author+) Shortcode creationEPSS 0.2%CVE-2026-120575MEDIUMPhoto Engine (Media Organizer & Lightroom) <= 6.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection NameEPSS 0.2%CVE-2025-5570MEDIUMAI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` ParameterEPSS 0.2%CVE-2026-120552MEDIUMSEO Engine <= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-then-Decode in build_title()EPSS 0.2%CVE-2025-11455MEDIUMPerfect Images <= 7.2.0 - Missing Authorization to Authenticated (Author+) Image ReplacementEPSS 0.2%