167293 matches found
WordPress Wired Impact Volunteer Management plugin < 2.8.2 - Subscriber+ Arbitrary RSVP Removal via wivm_remove_rsvp vulnerability
Subscriber+ Arbitrary RSVP Removal via wivmremoversvp vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Wired Impact Volunteer Management versions 2.8.2...
WordPress EPROLO Dropshipping plugin <= 2.4.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by hivesec in WordPress Plugin EPROLO Dropshipping versions = 2.4.2...
CVE-2026-76334
creationtimestamp| type| source ---|---|--- 2026-08-20 04:46:32+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...
CVE-2026-76321
creationtimestamp| type| source ---|---|--- 2026-08-20 04:46:02+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...
CVE-2026-2092 vulnerabilities
Vulnerabilities for packages: keycloak...
EUVD-2026-62961
In Splunk AI Toolkit versions below 6.0.0, a user that holds a role with the schedulesearch capability could cause a scheduled search to load and deserialize a model file through the apply search command. The improper access control is possible because Splunk AI Toolkit does not mark the apply...
EUVD-2026-62916
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use crafted report notification data to cause Splunk Secure Gateway to send a request to...
EUVD-2026-63108
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read sensitive Security Assertion Markup Language setup and instance settings information...
EUVD-2025-210743
IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to read or modify another user's command history due to an externally controlled filename...
PT-2026-80755
Name of the Vulnerable Software and Affected Versions Winter CMS versions prior to 1.2.13 Description The backend FileUpload form widget improperly trusts the file id POST parameter when resolving attachments. The getFileRecord function resolves the provided ID against the global system files tab...
PT-2026-79191
Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 3.0.29 Description Presenters can submit a presentationId through the '/api/graphql' endpoint that identifies a presentation belonging to a different meeting. The RemovePresentationPubMsgHdlr.scala function fail...
PT-2026-78944
Name of the Vulnerable Software and Affected Versions Altair versions prior to 5.2.3 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a version newer than 5.2.2...
PT-2026-79196
Name of the Vulnerable Software and Affected Versions TREK versions prior to 3.1.3 Description An authenticated user with file-edit permissions can disclose the existence and titles of reservations across private trip boundaries. The application fails to use the findForeignLinkTarget function to...
The vulnerability of the ALTER TABLE ALTER TYPE command in the PostgreSQL database management system allows a hacker to gain unauthorized access to delete or modify data.
The vulnerability of the ALTER TABLE/ALTER TYPE command in the PostgreSQL database management system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to delete or modify data...
PT-2026-79095
Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.9 Description Page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidde...
PT-2026-79261
Name of the Vulnerable Software and Affected Versions EverShop versions prior to 2.2.1 Description An authorization flaw exists in the customer update route. The route is incorrectly configured as public, allowing the admin authentication middleware to bypass caller verification. Additionally, th...
PT-2026-79188
TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...
PT-2026-78992
Name of the Vulnerable Software and Affected Versions EPROLO Dropshipping versions prior to 2.4.3 Description Broken access control allows unauthenticated users to gain unauthorized access to restricted areas or functions of the system. Recommendations Update to a version newer than 2.4.2...
PT-2026-79264
A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability WRR Enterprise Edition...
PT-2026-78994
Name of the Vulnerable Software and Affected Versions Chaplin versions prior to 2.6.9 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a version newer than 2.6.8...