CVE-2026-67616 Camaleon CMS 2.9.2 Missing Authorization via /admin/post_type drafts endpoint

Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-privileged user to create draft posts by bypassing role and permission checks. Attackers can send requests to the drafts endpoint using only...

CVE-2026-67616 Camaleon CMS 2.9.2 Missing Authorization via /admin/post_type drafts endpoint

Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-privileged user to create draft posts by bypassing role and permission checks. Attackers can send requests to the drafts endpoint using only...

CVE-2026-49132 OPNsense < 26.1.9 Stored XSS via Certificate Description Field

OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloads in the certificate description field via the trust certificate API. The unsanitized description value is persisted and later...

CVE-2026-49131 OPNsense < 26.1.9 Stored XSS via Firewall Rule Description Field

OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers with firewall rule management privileges to inject arbitrary HTML or JavaScript by embedding payloads in the firewall rule description field via the filter API endpoint. The unsanitized...

CVE-2026-41453

Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rottenleadin query parameter, which is concatenated without parameterized binding directly...

EUVD-2026-52287

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the savetemporary mode of mylistfunction.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' privat...

CVE-2026-69094

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the savetemporary mode of mylistfunction.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' privat...

CVE-2026-69086

SiYuan before v3.7.3 fails to validate the avID parameter in attribute-view read endpoints across all code branches, enabling path traversal that escapes the storage directory. Authenticated users with RoleReader permissions or anonymous clients when publish authentication is disabled can read JS...

CVE-2026-63545

Sharp and Toshiba Tec MFPs multifunction printers caches data internally when printing, and leave them uncleared. They may be accessed later by other users...

EUVD-2026-52250

Sharp and Toshiba Tec MFPs multifunction printers caches data internally when printing, and leave them uncleared. They may be accessed later by other users...

CVE-2026-63545

Sharp and Toshiba Tec MFPs multifunction printers caches data internally when printing, and leave them uncleared. They may be accessed later by other users...

CVE-2026-63545

Sharp and Toshiba Tec MFPs multifunction printers caches data internally when printing, and leave them uncleared. They may be accessed later by other users...

CVE-2026-4793

An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation...

CVE-2026-16289

The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, allowing any authenticated user such as a Subscriber to disclose the names and request dates of the users awaiting approval to join any group, including privat...

CVE-2025-15673

The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server...

EUVD-2026-52187

An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation...

CVE-2026-4793

An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation...

CVE-2026-16289 ProfileGrid < 6.0.0.0 - Subscriber+ Group Join Request Disclosure via pm_get_all_requests_from_group

The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, allowing any authenticated user such as a Subscriber to disclose the names and request dates of the users awaiting approval to join any group, including privat...

CVE-2026-16300

The ChamaWP WordPress plugin (versions before 1.0.13 ) contains a vulnerability where it fails to properly validate password reset requests . This flaw allows unauthenticated attackers to reset the passwords of arbitrary users, including administrators . Successful exploitation could result in a ...

CVE-2026-16300

The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover...