90789 matches found
EUVD-2026-90520
The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API credentials in plain text, allowing unauthenticated attackers to obtain those credentials...
CVE-2026-96255
The Payments for Hubtel WordPress plugin, in versions prior to 1.0.2 , is vulnerable to an unauthenticated information disclosure flaw. The plugin fails to restrict public access to a debug log that records payment requests. This log contains the store's payment gateway API credentials in plain t...
CVE-2026-101147 Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF
The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...
CVE-2026-101147
The Featured Image from URL (FIFU) WordPress plugin (before 6.0.8 ) and the Featured Image from URL (FIFU) Premium plugin (before 8.2.8 ) are vulnerable to a CSRF attack . The root cause is the failure to correctly enforce the REST API nonce , which can be bypassed using a crafted URL. An attacke...
CVE-2026-101147 Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF
The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...
EUVD-2026-90506
The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...
cve-exploit-lookup-api
CVE & Exploit Lookup API A unified Flask RESTful API servic...
CVE-2026-82825
Hitachi Coding Software Suite contains a vulnerability related to Missing Authentication for Critical Function. This allows an unauthenticated attacker to invoke a critical API, potentially leading to unauthorized retrieval or alteration of sensitive information, or unauthorized manipulation. Thi...
CVE-2026-82825
The Hitachi Coding Software Suite (versions through 3.3.0) is vulnerable to a Missing Authentication for Critical Function flaw. This vulnerability allows an unauthenticated attacker to invoke a critical API, which may lead to the unauthorized retrieval or alteration of sensitive information, or ...
CVE-2026-82825 Missing proper authentication for critical APIs may allow sensitive information to be obtained or modified, or unauthorized operations to be performed
Hitachi Coding Software Suite contains a vulnerability related to Missing Authentication for Critical Function. This allows an unauthenticated attacker to invoke a critical API, potentially leading to unauthorized retrieval or alteration of sensitive information, or unauthorized manipulation. Thi...
EUVD-2026-90494
Hitachi Coding Software Suite contains a vulnerability related to Missing Authentication for Critical Function. This allows an unauthenticated attacker to invoke a critical API, potentially leading to unauthorized retrieval or alteration of sensitive information, or unauthorized manipulation. Thi...
Exploit for CVE-2026-96349
CVE-2026-96349 — WordPress SiteSkite ≤ 2.1.8 → unauthenticated...
CVE-2026-103534
A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/snapshots of the component Snapshot Model. This manipulation causes improper access controls. Remote exploitation of the attack is possibl...
CVE-2026-103534
The David-Crty databasement software (versions up to 1.7.1 ) contains a vulnerability in the Snapshot Model component. Specifically, the SnapshotPolicy.viewAny/SnapshotPolicy.view functions within the /api/v1/snapshots file suffer from improper access controls . This flaw allows for remote exploi...
CVE-2026-102278 vulnerabilities
Vulnerabilities for packages: authentik, wazuh-dashboard, opentelemetry-auto-instrumentations-node, authentik-fips, lambda-nodejs, nextcloud-server, pelias-api, jupyter-base-notebook, rancher-api-ui, foxx-cli, langfuse-fips, unleash-fips, npm, commitizen, verdaccio, commercial-gitlab-rails-ee,...
CVE-2026-102277 vulnerabilities
Vulnerabilities for packages: authentik, wazuh-dashboard, opentelemetry-auto-instrumentations-node, authentik-fips, lambda-nodejs, nextcloud-server, pelias-api, jupyter-base-notebook, rancher-api-ui, foxx-cli, langfuse-fips, unleash-fips, npm, commitizen, verdaccio, commercial-gitlab-rails-ee,...
GHSA-Q2HR-2G5M-VWHR vulnerabilities
Vulnerabilities for packages: authentik, wazuh-dashboard, opentelemetry-auto-instrumentations-node, authentik-fips, lambda-nodejs, nextcloud-server, pelias-api, jupyter-base-notebook, rancher-api-ui, foxx-cli, langfuse-fips, unleash-fips, npm, commitizen, verdaccio, commercial-gitlab-rails-ee,...
GHSA-QHR7-859C-M2P7 vulnerabilities
Vulnerabilities for packages: authentik, wazuh-dashboard, opentelemetry-auto-instrumentations-node, authentik-fips, lambda-nodejs, nextcloud-server, pelias-api, jupyter-base-notebook, rancher-api-ui, foxx-cli, langfuse-fips, unleash-fips, npm, commitizen, verdaccio, commercial-gitlab-rails-ee,...
CVE-2026-103533 David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal
A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schemaname result...
CVE-2026-103533
A path traversal vulnerability exists in the database-servers API Endpoint of David-Crty databasement versions up to 1.7.1 . The flaw is located in the app/Http/Requests/Api/V1/RestoreRequest.php file and stems from the improper handling of the schema_name argument. An attacker can potentially la...