CVE-2026-84907: Missing Authorization

The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline local payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never checking that the caller owns the order, allowing unauthenticated attackers to reset...

CVE-2026-51990: Improper Control of Generation of Code

An issue in Sogou Sogou Input Method 16.3.0.3498 fixed in 16.3.0.3498 allows a remote attacker to execute arbitrary code via the bizhelper.exe component...

CVE-2026-91857 MISP: State-changing actions accessible via GET request enabling CSRF

Affected versions of MISP expose several state-changing controller actions without restricting them to POST. The affected actions are: - EventReportsController::purgeUnusedPictures - NoticelistsController::enableNoticelist - ServersController::removeOrphanedCorrelations -...

CVE-2026-91819

Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs...

EUVD-2026-78317

Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs...

CVE-2026-91819 MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent

Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs...

CVE-2026-91819 MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent

Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs...

CVE-2026-91819

MISP (versions ≤2.5.45) is vulnerable in its BetterSecurityComponent due to how it interacts with CakePHP's request-method override processing. When an override value outside the normal write verbs (POST, PUT, PATCH, DELETE) is supplied — for example _method=GET — CakePHP clears the parsed reques...

CVE-2026-91819 MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent

Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs...

CVE-2026-88619

1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes scheduled-job management endpoints without method-level permission checks, allowing a low-privileged authenticated user to access functionality...

CVE-2026-91819: Cross-Site Request Forgery (CSRF)

Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs...

CVE-2026-89027: Missing Authentication for Critical Function

miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or...

PT-2026-91893

Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs...

CVE-2026-91145

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

CVE-2026-91145 Activiti through 7.1.0.M6 Expression Injection via Mail Task

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

CVE-2026-91145 Activiti through 7.1.0.M6 Expression Injection via Mail Task

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

CVE-2026-91145 Activiti through 7.1.0.M6 Expression Injection via Mail Task

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

CVE-2026-46636

A flaw was found in Twig, a template language for PHP. The SecurityPolicy::checkMethodAllowed function unconditionally whitelists all method calls on instances of Twig\Markup and its subclasses. This allows an attacker, by passing an object of a Markup-derived class into a sandboxed template, to...

EUVD-2026-77691

flat-to-nested converts a hierarchy from a flat representation to a nested representation. Prior to 1.1.2, FlatToNested.prototype.convert in index.js uses attacker-influenced id and parent record fields directly as keys in the plain temp and pendingChildOf objects. When parent or id is proto,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: AppArmor: The recursive profile removal method has been replaced with an iterative approach. The profile removal code uses recursion when removing nested profiles, which can lead to kernel stack exhaustion and system crashes...