CVE-2026-77781: Uncaught Exception

Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys. The FETCH, EXISTS and DELETE methods throw an exception when on malformed regular expressions. Each method falls back to a regex match when the key is not already stored in the hash, compiling the...

CVE-2026-77781

Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys. The FETCH, EXISTS and DELETE methods throw an exception when on malformed regular expressions. Each method falls back to a regex match when the key is not already stored in the hash, compiling the...

CVE-2026-34949

Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances — a file created during the setup process that prevents users from performing write actions. This issue has been fixed in version 3.2.3...

CVE-2026-77086

SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal via directory traversal sequences. Attackers with admin access can write arbitrary files to any location via install operatio...

Exploit for CVE-2026-0603

CVE-2026-0603 Hibernate ORM Injection / Second-Order SQL Injec...

CVE-2026-73040

CVE-2026-73040 is a path traversal vulnerability in Dockge , a Docker Compose management tool. The stack-name allow-list check (^[a-z0-9_-]+$) is enforced only in the write path (save()), while read and delete operations (Stack.getStack, path getter) pass the name directly to path.join without va...

Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)

Summary Backpack CRUD's list and read operations correctly apply any query scopes registered via addClause / addBaseClause e.g. tenant isolation, user ownership. However, the Update, Delete, and Reorder operations bypassed these scopes, fetching records directly from the unscoped model query. An...

GHSA-VGMV-8XJC-6RCH Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)

Summary Backpack CRUD's list and read operations correctly apply any query scopes registered via addClause / addBaseClause e.g. tenant isolation, user ownership. However, the Update, Delete, and Reorder operations bypassed these scopes, fetching records directly from the unscoped model query. An...

CVE-2026-63040 Apache InLong: Missing authorization in StreamSource forceDelete

Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache...

CVE-2026-64969 Insecure Direct Object Reference in ATutor

ATutor is vulnerable to Insecure Direct Object Reference IDOR attack in profile picture related endpoints. Any authenticated user, including a student, can supply another user's memberid in a POST request to the profile album endpoint and permanently delete that user's profile picture, including...

WordPress Copy & Delete Posts plugin < 1.5.5 - Authenticated Arbitrary Post Deletion via Missing Object-Level Authorization vulnerability

Authenticated Arbitrary Post Deletion via Missing Object-Level Authorization vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Duplicate Post versions 1.5.5...

PT-2026-79047

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Online Food Ordering System version 1.0 Description A SQL injection flaw exists in the /admin/ajax.php?action=delete category endpoint. This issue occurs when the ID argument is manipulated, allowing a remote attacker to...

CVE-2026-55489: Authorization Bypass Through User-Controlled Key

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting...

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in next-tinacms-s3 and sibling production media adapters vulnerability discovered by ? in WordPress Npm next-tinacms-cloudinary versions 26.0.4...

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in next-tinacms-s3 and sibling production media adapters vulnerability discovered by ? in WordPress Npm next-tinacms-azure versions 14.0.4...

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in next-tinacms-s3 and sibling production media adapters vulnerability discovered by ? in WordPress Npm next-tinacms-dos versions 23.0.4...

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in next-tinacms-s3 and sibling production media adapters vulnerability discovered by ? in WordPress Npm next-tinacms-s3 versions 23.0.4...

GHSA-8MQ9-5FW2-5RM4 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

Summary The production media handler shipped by next-tinacms-s3 createMediaHandler in packages/next-tinacms-s3/src/handlers.ts accepts an attacker-chosen ?key= query parameter and returns an AWS-signed PutObject URL whose Key is that value, with no check that the key falls under the operator's...

CVE-2026-59992 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without...

CVE-2026-59992 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without...