CVE-2026-62041

The WP Event Manager plugin for WordPress (versions

WordPress WP Event Manager plugin <= 3.4.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by superx in WordPress Plugin WP Event Manager versions = 3.4.1...

usbrip

usbrip heredado de "USB Ripper", no "USB R.I.P." es una herramienta forense simple con interfaz de línea de comandos que le permite rastrear artefactos de dispositivos USB es decir, historial de eventos USB en máquinas Linux. Índice: Descripción Inicio Rápido Demostración Estructura del Registro...

EUVD-2026-95396

Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network...

PT-2026-108878

Name of the Vulnerable Software and Affected Versions WP Event Manager versions prior to 3.4.2 Description A missing authorization issue exists that allows the exploitation of incorrectly configured access control security levels. Recommendations Update to version 3.4.2 or later...

PT-2026-108911

Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting XSS vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the publ...

CVE-2026-79363

Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting XSS vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the publ...

CVE-2026-79363: Improper Neutralization of Input During Web Page Generation

Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting XSS vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the publ...

CVE-2026-62041: Missing Authorization

Missing Authorization vulnerability in Ashok Dudhat WP Event Manager wp-event-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Manager: from n/a through 3.4.1...

CVE-2026-79363

Cloudron versions 9.1.7 and 9.2 are susceptible to a stored cross-site scripting (XSS) vulnerability within the Branding Footer feature. An authenticated administrator can exploit this by storing crafted HTML containing JavaScript event handlers in the Footer setting. Because the application fail...

CVE-2026-83947

Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network...

CVE-2026-83947

A missing authorization vulnerability in Azure Event Grid allows an authorized attacker to perform spoofing over a network. The issue is classified under CWE-862 and carries a HIGH base severity score of 7.7. While the specific root cause and affected versions are not detailed in the provided doc...

com.consol.citrus:citrus-vertx (2.2), com.erudika:para (>=1.5.1, <=1.8.0) +51 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (3.2.3)

com.hazelcast:hazelcast MAVEN version 3.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.consol.citrus:citrus-vertx 2.2 - com.erudika:para =1.5.1, =1.2.1, =1.4.4 -...

CVE-2026-107397

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to the same minutes, t...

CVE-2026-107391

music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor fr...

EUVD-2026-95253

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to the same minutes, t...

EUVD-2026-95212

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is...

CVE-2026-107394

The event management system Indico is vulnerable to a Server-Side Request Forgery (SSRF) flaw in versions prior to 3.3.13 . The root cause is an incomplete check in the Flask-Multipass authentication system, which failed to cover an edge case identified in a previous fix for CVE-2026-25738. This ...

CVE-2026-107394 Indico: Incomplete Server-Side Request Forgery (SSRF) check

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is...

CVE-2026-107394 Indico: Incomplete Server-Side Request Forgery (SSRF) check

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is...