1276256 matches found
CVE-2026-93455
django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page...
CVE-2026-68493
After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of...
CVE-2026-82980
Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves files from the absolute request URI without verifying that the path segment matches the authenticated session user. This enables: Cross-user manual locks :...
EUVD-2026-82617
Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves files from the absolute request URI without verifying that the path segment matches the authenticated session user. This enables: Cross-user manual locks :...
CVE-2026-68493
After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of...
EUVD-2026-82622
The Photos app's filter-based "smart albums" build their file listing using the search configuration photosSourceFolders of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with another user, that user's own folder configuration is...
CVE-2026-82980
Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves files from the absolute request URI without verifying that the path segment matches the authenticated session user. This enables: Cross-user manual locks :...
CVE-2026-82985
The Photos app's filter-based "smart albums" build their file listing using the search configuration photosSourceFolders of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with another user, that user's own folder configuration is...
CVE-2026-82985
The Photos app's filter-based "smart albums" build their file listing using the search configuration photosSourceFolders of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with another user, that user's own folder configuration is...
EUVD-2026-82623
After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of...
CVE-2026-68493
After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of...
CVE-2026-82980
CVE-2026-82980 affects a WebDAV (DAV) plugin where file paths are resolved from the absolute request URI without verifying that the path segment matches the authenticated session user. This allows any authenticated user to perform cross-user manual locks on files they do not own, blocking writes ...
CVE-2026-68493
CVE-2026-68493 describes a vulnerability where, after guessing a 62¹⁵ complex unique identifier , a malicious logged-in user could retrieve a list of memberships for a circle they are not a member of. The CVSS 3.0 base score is 3.1 (Low) , reflecting high attack complexity and low confidentiality...
CVE-2026-82985
CVE-2026-82985 affects the Photos app 's filter-based smart albums . The root cause is that when a smart album is shared, the file listing is built using the viewer's photosSourceFolders search configuration rather than the album owner's configuration. This allows a user viewing a shared smart al...
EUVD-2026-82615
django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page...
CVE-2026-93455 django-page-cms through 2.0.13 Unauthorized Content Access via Staff Account
django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page...
CVE-2025-69295
CVE-2025-69295 — TeconceTheme Coven Core Blind SQL Injection Vulnerability CVE-2025-69295 is a SQL Injection vulnerability affecting the Coven Core component of the TeconceTheme Coven Core WordPress theme. The vulnerability exists due to improper neutralization of user-supplied input before it is...
EUVD-2026-82600
Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network...
EUVD-2026-82608
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the setcustomerobject due to missing validation on a user controlled key. This makes it possible...