223873 matches found
CVE-2026-14926 FluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOR
The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any authenticated customer to act on another customer's subscription changing its payment method, or...
CVE-2026-16797 ShopLentor <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'optionSection' Parameter
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible...
CrushFTP < 10.5.1 - Unauthenticated Remote Code Execution
CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes. id: CVE-2023-43177 info: name: CrushFTP 10.5.1 - Unauthenticated Remote Code Execution author: iamnoooob,rootxharsh,pdresearch severity: critical description: | CrushFTP prior...
Security update for the Linux Kernel (Live Patch 35 for SUSE Linux Enterprise 15 SP5)
This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.136 fixes various security issues: The following security issues were fixed: CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060...
EUVD-2026-49658
Unauthenticated Broken Access Control in Ad Invalid Click Protector AICP = 1.3.0 versions...
EUVD-2026-49668
Unauthenticated Broken Access Control in Xendit Payment = 7.1.0 versions...
EUVD-2026-49639
An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of the filemanagecontrol.php component...
PT-2026-65626
Name of the Vulnerable Software and Affected Versions goshs versions prior to 2.1.5 Description The sendFile function in the httpserver/handler.go file incorrectly derives the authorization filename from the raw req.URL.Path while opening the file using a cleaned path. This discrepancy allows an...
Kibana 9.4.x < 9.4.3 Multiple Vulnerabilities (ESA-2026-54 / ESA-2026-58)
The version of Kibana installed on the remote host is 9.4.x prior to 9.4.3. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-54 and ESA-2026-58 advisories. - Improper Access Control CWE-284 in Kibana can lead to unauthorized modification of Entity Analytics...
PT-2026-65632
It was discovered that Samba's pam winbind incorrectly handled home directory ownership when mkhomedir was enabled. A local attacker could possibly use this issue to cause a denial of service by triggering a change in ownership of the root directory. CVE-2026-15779 Arjun Basnet, Douglas Bagnall,...
PT-2026-65598
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console...
PT-2026-65520
Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can...
CVE-2026-65445
Unauthenticated Broken Access Control in Ad Invalid Click Protector AICP = 1.3.0 versions...
CVE-2026-66473
Unauthenticated Broken Access Control in Xendit Payment = 7.1.0 versions...
Malicious code in motion-forge-css (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f9c883a4865db328dff8b43c279a353b6ad494416a665e0201fdca7b6ba4daa Package advertises itself as a small PostCSS vendor-prefix / CSS-variable-injection plugin but ships a single 105KB obfuscator.io-packed bundle as it...
CVE-2026-65445 WordPress Ad Invalid Click Protector (AICP) plugin <= 1.3.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Ad Invalid Click Protector AICP = 1.3.0 versions...
CVE-2026-65445
Unauthenticated Broken Access Control in Ad Invalid Click Protector AICP = 1.3.0 versions...
CVE-2026-65445
The CVE-2026-65445 entry concerns the WordPress Ad Invalid Click Protector (AICP) plugin and its