WordPress TS Poll < 2.4.0 - SQL Injection

WordPress TS Poll plugin 2.4.0 contains a SQL injection caused by lack of sanitization and escaping of a parameter before using it in a SQL statement, letting attackers perform SQL injection attacks, exploit requires admin privileges. id: CVE-2024-8625 info: name: WordPress TS Poll 2.4.0 - SQL...

CVE-2026-19478

CVE-2026-19478 Eliminazione non autenticata di progetti GitLab GraphQL ★ CVE-2026-19478 GitLab GraphQL @glintroduced PoC di invocazione arbitraria di metodi non autenticata ★ https://github.com/user-attachments/assets/bb5d5f8a-a9bf-4148-854b-14c25c501d4b Panoramica CVE-2026-19478 è una...

CVE-2026-7028-SQLI

CodeAstro-Online-Job-Portal-SQLi-Delete-All التفاصيل البائع: CodeAstro المنتج: مشروع بوابة الوظائف عبر الإنترنت بلغة PHP وMySQL الإصدار: 1.0 نوع الثغرة: حقن SQL CWE: CWE-89 الموقع المتأثر: /admin/jobs-admins/delete-jobs.php المعامل: id GET التأثير: يسمح بحذف جميع سجلات الوظائف في قاعدة البيانات...

CVE-2026-55640 Nextcloud MCP Server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup...

CVE-2026-55640

Nextcloud MCP Server prior to 0.117.2 contains an authentication bypass in the POST /webhooks/nextcloud endpoint. The WEBHOOK_SECRET defaults to None and startup validation does not enforce it, allowing unauthenticated requests to handle_nextcloud_webhook(). The payload["user"]["uid"] field is at...

CVE-2026-78378

Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlled input before it is incorporated into Redis SCAN MATCH patterns. The /api/health/ endpoint attempted to resolve the supplied name to a known group or market, but when resolutio...

Astra Linux – Vulnerability in WebKit2GTK

“Clear History and Website Data” did not successfully clear the browsing history. The issue was resolved through improved data deletion mechanisms. This issue has been fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, iOS 14.3, and iPadOS 14.3, as we...

CVE-2026-63040

Apache InLong versions 2.0.0 through before 2.4.0 are affected by a missing authorization check in the StreamSource component (specifically the forceDelete function). Any authenticated user can logically delete all stream sources , resulting in high integrity and availability impact (CVSS 3.1 sco...

EUVD-2026-63259

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vulnerability in the MongoDB node's Find, Delete, and Aggregate operations, which parse the Query parameter as JSON after expression resolution without sanitizing MongoDB operators. An attacker who can influence the resolved query...

EUVD-2026-62962

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all relevant data in experiment history, including data associated with other users. The vulnerability is possible because Splunk AI Toolkit does not preserve the trusted experiment scope...

EUVD-2026-62901

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search Processing Language 2 SPL2 modules across all apps and users on the instance through the SPL2 module management Representational State Transfer REST API. Thi...

PT-2026-78926

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions prior to 2.33.4 n8n versions prior to 2.34.1 Description A NoSQL injection issue exists in the MongoDB node's Find, Delete, and Aggregate operations. The software parses the Query parameter as JSON...

CVE-2026-76397

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all relevant data in experiment history, including data associated with other users. The vulnerability is possible because Splunk AI Toolkit does not preserve the trusted experiment scope...

CVE-2026-76336

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search Processing Language 2 SPL2 modules across all apps and users on the instance through the SPL2 module management Representational State Transfer REST API. Thi...

CVE-2026-76827

A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to...

EUVD-2026-63091

A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to...

CVE-2026-76827

A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to...

EUVD-2026-62284

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records...

CVE-2026-18779

The TrueBooker WordPress plugin (versions before 1.2.7 ) has a missing authorisation check in the update_appointment_booked AJAX action, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records. The vulnerability was disc...

PT-2026-78720

A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to...