467 matches found
EUVD-2026-63206
The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored X...
WordPress Nested Pages plugin < 3.2.15 - Editor+ Stored XSS via Post Title vulnerability
Editor+ Stored XSS via Post Title vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Nested Pages versions 3.2.15...
PYSEC-2026-3663 GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
Summary Multiple GeoLens read/link endpoints authorized only the resource named in the request URL a map, a VRT, a source dataset, an AI request and failed to re-authorize a second, caller-influenced dataset that the request reached through a relationship, layer reference, mosaic source, or reque...
WordPress Eventin plugin < 4.1.20 - Editor+ Local File Inclusion via speaker_template Setting vulnerability
Editor+ Local File Inclusion via speakertemplate Setting vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Event SOlution versions 4.1.20...
WordPress GeoDirectory plugin < 2.8.110 - Editor+ Stored XSS via Place Categories vulnerability
Editor+ Stored XSS via Place Categories vulnerability discovered by Krugov Artyom in WordPress Plugin GeoDirectory versions 2.8.110...
CVE-2026-72585
An authorization bypass in Grafana allows Editor-role users to delete protected contact points because a previous security patch for updating them missed the deletion process. Mitigation To mitigate this issue grant the Editor role only to trusted users and restrict access to the Grafana UI/API t...
Linux Distros Unpatched Vulnerability : CVE-2026-72585
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points receivers without the required...
CVE-2026-72585
Rejected reason: Red Hat CNA-LR concluded that this CVE is not valid...
CVE-2026-72585
Rejected reason: Red Hat CNA-LR concluded that this CVE is not valid...
UBUNTU-CVE-2026-72585
An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points receivers without the required alert.notifications.receivers.protected:write permission...
CVE-2026-72585
This CVE is rejected/not used and does not represent an active vulnerability entry.
CVE-2026-72585 Grafana - Incomplete Fix for CVE-2026-21724 Allows Editor Role to Delete Protected Contact Points
An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points receivers without the required alert.notifications.receivers.protected:write permission...
CVE-2026-72585
An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points receivers without the required alert.notifications.receivers.protected:write permission...
EUVD-2026-55221
An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points receivers without the required alert.notifications.receivers.protected:write permission...
PT-2026-69469
Name of the Vulnerable Software and Affected Versions Grafana versions prior to 13.2.1 Description An authorization bypass allows a user with the Editor role to delete protected contact points receivers without possessing the necessary alert.notifications.receivers.protected:write permission. Thi...
CVE-2026-48093 Code Embed - Contributor Stored Cross-Site Scripting via Remote URL Embed
The Code Embed WordPress plugin prior to version 2.6.1 is vulnerable to stored Cross-Site Scripting XSS through the external URL embed feature in post content. The vulnerable code scans rendered content for URL embed tokens, fetches the remote URL, and inserts the remote response body into the pa...
CVE-2026-16065
The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above including its custom shop-management roles to perform SQL injection attacks...
CVE-2026-16065 Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import
The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above including its custom shop-management roles to perform SQL injection attacks...
CVE-2026-16065 Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import
The Welcart e-Commerce WordPress plugin before 2.11.32 does not properly sanitise a value taken from an imported CSV file before using it in a SQL statement, allowing users with the Editor role and above including its custom shop-management roles to perform SQL injection attacks...