CVE-2026-50165

alf.io , an open-source ticket reservation system, contains an Improper Access Control flaw in its organization and event "single configuration" endpoints. These endpoints require only organization or event ownership but accept an arbitrary configuration key, performing a lookup that includes sys...

CVE-2026-50165 alf.io has Improper Access Control for Organization Owners that Exposes System Secrets

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuratio...

EUVD-2026-75140

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuratio...

CVE-2026-50165 alf.io has Improper Access Control for Organization Owners that Exposes System Secrets

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuratio...

CVE-2026-50165 alf.io has Improper Access Control for Organization Owners that Exposes System Secrets

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuratio...

DRUPAL-CONTRIB-2026-149

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module stores sensitive authentication information in a manner that could allow disclosure to users with access to configuration or related...

DRUPAL-CONTRIB-2026-141

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The miniorange\saml module does not correctly restrict access to certain functionality intended for administrative use. This could allow...

CVE-2026-8044

CWE-88: Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters...

EUVD-2026-75097

CWE-88: Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters...

CVE-2026-8044

CWE-88: Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters...

CVE-2026-8044

CVE-2026-8044 is a CWE-88 (Argument Injection) vulnerability in Schneider Electric software, enabling remote code execution when a privileged attacker supplies malicious arguments as backup configuration parameters . The CVSS 4.0 score is 8.6 (HIGH) , with low attack complexity and no user intera...

CVE-2026-8044

CWE-88: Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters...

Prisma Access Agent: Information Disclosure Vulnerability on Linux

An information disclosure vulnerability in the Palo Alto Networks Prisma® Access Agent on Linux enables a local user to access sensitive configuration data and credentials. The Prisma Access Agent on macOS, Windows, iOS, Android and Chrome OS is not affected. Work around: No known workarounds or...

Checkov by Prisma Cloud: Code Execution via Auto-Loaded Configuration File

A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can allow arbitrary code execution when Checkov scans a directory that contains an attacker-controlled configuration file. Work around: Until a fixed version is deployed, avoid running Checkov over untrusted content, an...

droidground v1.0.15

DroidGround Website | Demo In traditional CTF challenges , it's common to hide flags in files on a system, requiring attackers to exploit vulnerabilities to retrieve them. However, in the Android world, this approach doesn't work well. APK files are easily downloadable and reversible, so placing ...

BIT-KIBANA-2026-82302 Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180...

BIT-ELK-2026-82302 Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180...

CVE-2026-85133

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent...

CVE-2026-80339

The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that...

CVE-2026-85133 WPLP Cookie Consent < 4.4.2 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent...