CVE-2026-3174

The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return endpoint in all versions up to, and including, 5.27.4. This makes it possible for unauthenticated attackers to overwrite the site...

EUVD-2026-72701

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, wit...

EUVD-2026-72697

The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return endpoint in all versions up to, and including, 5.27.4. This makes it possible for unauthenticated attackers to overwrite the site...

PT-2026-87070

A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a...

PT-2026-87030

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, wit...

The vulnerability of the configuration file 4_testintegration_fim-tier-0-1-win.yml on the Wazuh security monitoring and threat detection platform allows a perpetrator to gain access to and modify this data.

The vulnerability of the configuration file 4testintegrationfim-tier-0-1-win.yml of the security monitoring and threat detection platform Wazuh is related to insufficient protection of registration data. Exploiting this vulnerability can allow a malicious actor to gain read access and modify data...

The vulnerability of the POS platform component of Oracle Hospitality Simphony allows a malicious individual to gain unauthorized access to read, create, delete, and modify data, or to cause service interruptions.

The vulnerability of the Oracle Hospitality Simphony sales management platform component relates to insufficient access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to read, create, delete, and modify data, or cause service interruptions...

PT-2026-86384

BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit readthrough function that allows authenticated users to modify other users' reading records. Attackers can exploit sequential ReadThrough IDs to overwrite arbitrary users' start dates, finish dates, progress, and...

CVE-2026-85787

An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user...

EUVD-2026-71748

An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user...

CVE-2026-85787 An incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-server

An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user...

CVE-2026-85787 An incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-server

An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user...

CVE-2026-85787

CVE-2026-85787 affects the SQL validation component of Amazon awslabs postgres-mcp-server (versions before 1.1.7 ). Due to an incomplete list of disallowed inputs , an unauthenticated actor can place crafted SQL into content submitted when an authenticated user interacts with the MCP server, enab...

CVE-2026-85547 Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP

A cross-site request forgery CSRF vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request. MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept...

CVE-2026-85540

DreamMaker , a product developed by Interinfo , is affected by a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents. The vulnerability is rated HIGH with a CVSS v3.1 base score of 8.8 (network vector, low com...

kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC

A flaw was found in the Linux kernel's NFSv4 implementation. A local user could exploit a vulnerability where opening a file with OTRUNC truncate and ORDONLY read-only flags would bypass the necessary write permission checks. This oversight allows an attacker to truncate a file without having...

CVE-2026-85547: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request. MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept...

PT-2026-86254

An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user...

CVE-2026-85787: Incomplete List of Disallowed Inputs

An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user...

The vulnerability of the set_course_mode_price() function on the online training platform Open edX allows a violator to gain access to read and modify data.

The vulnerability of the setcoursemodeprice function on the online training platform Open edX is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain access and modify data...