129888 matches found
CVE-2026-19435 Copy & Delete Posts < 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure
The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content...
CVE-2026-14601 Link Whisper < 0.9.7 - Editor+ SQL Injection via domain Parameter
The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks...
CVE-2026-76156
OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root...
CVE-2026-76156 Datiphy Data Management Center - Improper Neutralization of Special Elements used in an OS Command
OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root...
EUVD-2026-63794
OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root...
CVE-2026-76156
Datiphy Data Management Center v8.3.0 through v8.5.1 has an OS command injection flaw (CWE-78) in its API endpoint, allowing authenticated administrators to execute arbitrary OS commands as root. No patch version or workaround is mentioned in the provided documents. Exploitation details are not p...
EUVD-2026-63692
Server-side request forgery ssrf in Azure Active Directory allows an authorized attacker to elevate privileges over a network...
EUVD-2026-63748
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...
EUVD-2026-63695
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local authenticated attacker to execute arbitrary code due to a heap-based buffer overflow...
PT-2026-79405
Name of the Vulnerable Software and Affected Versions TL-MR6400 version v7 Description A stack-based buffer overflow occurs in the firmware update functionality due to the unsafe processing of attacker-controlled metadata within a firmware image. An authenticated attacker can exploit this to...
Cisco Unified Intelligence Center < 12.6 / 12.6.x < 12.6(2) ES08 / 15.0.x < 15.0(1) SU2 SQL Injection (cisco-sa-cuic-sql-inject-2qbfWSm5)
A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...
PT-2026-79492
Name of the Vulnerable Software and Affected Versions LeafWiki versions 0.3.0 through 0.10.0 Description LeafWiki contains a path traversal flaw within the asset rename functionality. This issue occurs because the application fails to properly sanitize user-supplied file paths during the rename...
Zabbix Server 6.0.x < 6.0.47 / 7.0.x < 7.0.27 / 7.4.x < 7.4.11 DoS (ZBX-28075)
The version of Zabbix Server installed on the remote host is 6.0.x prior to 6.0.47, 7.0.x prior to 7.0.27, or 7.4.x prior to 7.4.11. It is, therefore, affected by a denial of service vulnerability: - An authenticated administrator is able to crash Zabbix server by creating specifically crafted...
UBUNTU-CVE-2026-73196
A flaw was found in FreeIPA. A low-privilege authenticated user can ex...
PT-2026-79378
Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files...
PT-2026-79394
OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server ...
PT-2026-79399
Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain...
CVE-2026-46682
BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala...