CVE-2026-87782

The Koinonia Link WordPress plugin (versions before 1.1.5 , specifically 1.1.2-1.1.4 ) contains a privilege escalation vulnerability. The plugin fails to verify if a user has the necessary permissions to modify roles when saving a role selection during a profile update. This flaw allows any authe...

EUVD-2026-94187

The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile update, allowing any authenticated user, such as a subscriber, to grant themselves the Administrator role...

CVE-2026-87782 Koinonia Link 1.1.2 - 1.1.4 - Subscriber+ Privilege Escalation to Administrator

The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile update, allowing any authenticated user, such as a subscriber, to grant themselves the Administrator role...

CVE-2026-19572

A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator session without providing valid credentials...

CVE-2026-19572 FlexNet Publisher lmadmin SOAP Authentication Bypass Vulnerability

A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator session without providing valid credentials...

CVE-2026-19572 FlexNet Publisher lmadmin SOAP Authentication Bypass Vulnerability

A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator session without providing valid credentials...

CVE-2026-19572

A security vulnerability exists in FlexNet Publisher lmadmin within a SOAP handler . A hardcoded authentication bypass allows an unauthenticated user to obtain a privileged administrator session without providing valid credentials. No information regarding specific affected versions, remediation ...

EUVD-2026-94166

A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator session without providing valid credentials...

cve-2023-22515-1

🛡️ CVE-2023-22515: In-Depth Analysis of Confluence Privilege Escalation Vulnerability !IMPORTANT Urgent Security Alert : This vulnerability has a CVSS score of 10.0 Critical , the highest risk level. If you are using an affected version, immediate patching is required. 1. Overview CVE-2023-22515...

PT-2026-107391

A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator session without providing valid credentials...

PT-2026-107478

Operating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application incorporates the value of the field corresponding to the repository into an svn.exe command without properly validating it. An authenticated user with administrator privileges coul...

PT-2026-107491

Name of the Vulnerable Software and Affected Versions SonicWall SMA1000 affected versions not specified Description An OS Command Injection issue exists where special elements used in an OS command are not properly neutralized. This allows a remote authenticated attacker with administrator...

CVE-2026-97208

The Gitea API endpoint for creating push mirrors POST /api/v1/repos/owner/repo/pushmirrors checked only whether mirroring was enabled and not the mirror DISABLENEWPUSH setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where th...

CVE-2026-97208 Gitea push mirror API bypass of DISABLE_NEW_PUSH policy

The Gitea API endpoint for creating push mirrors POST /api/v1/repos/owner/repo/pushmirrors checked only whether mirroring was enabled and not the mirror DISABLENEWPUSH setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where th...

EUVD-2026-94053

The Gitea API endpoint for creating push mirrors POST /api/v1/repos/owner/repo/pushmirrors checked only whether mirroring was enabled and not the mirror DISABLENEWPUSH setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where th...

CVE-2026-86684 Gitea push mirror local path check uses the repository owner

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

CVE-2026-96404

When Gitea's web installer is reachable against a database that already contains users, such as after INSTALLLOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its...

CVE-2026-101156

A stored cross-site scripting XSS vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affected configuration. Successful...

CVE-2026-101156 Security Advisory 0192

A stored cross-site scripting XSS vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affected configuration. Successful...

CVE-2026-96404 Gitea installer authentication bypass for existing accounts

When Gitea's web installer is reachable against a database that already contains users, such as after INSTALLLOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its...