PT-2026-107405

The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromi...

CVE-2017-11882

CVE-2017-11882 Overview From the perspective of exploit effectiveness, it can kill all versions of Office from 2003 to 2016, and the entire attack environment is very simple to build. This vulnerability is caused by the Equation Editor in Office software. Because the editor process does not...

CVE-2026-34212

CVE-2026-34212 Docmost accepted a javascript: URL inside an attachment node, preserved it through storage and rendering, and turned it back into a clickable anchor in the Docmost origin. Intro I identified, responsibly disclosed, and reproduced a High-severity stored XSS issue in Docmost , the...

grafana: Grafana: Privilege escalation via dashboard overwrite

A flaw was found in Grafana. A user with editor privileges can overwrite a dashboard not owned by them, leading to privilege escalation on that specific dashboard. This allows the editor to gain administrative control over the affected dashboard...

cve-2019-17497

CVE-2019-17497 Detalles de CVE PDF-XChange Editor anterior a 8.0.330.0 tiene una vulnerabilidad de robo de hash NTLM SSO mediante archivos FDF o XFDF manipulados un problema relacionado con CVE-2018-4993. Por ejemplo, se envía un hash NTLM para un enlace a \attacker.loca\C$\eee.pdf sin interacció...

CVE-2026-48907

CVE-2026-48907 CVE-2026-48907 is a critical improper access control vulnerability in the JCE editor extension for Joomla. It allows unauthenticated attackers to create new editor profiles, which can ultimately lead to arbitrary PHP file upload and remote code execution on affected systems Also if...

CVE-2026-104757 WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerability

Editor Privilege Escalation in Import and export users and customers = 2.5.5 versions...

CVE-2026-104757 WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerability

Editor Privilege Escalation in Import and export users and customers = 2.5.5 versions...

EUVD-2026-93026

Editor Remote Code Execution RCE in Tabs = 2.5 versions...

WP < 7.1.3 - Contributor+ DoS via Block Editor URL Details

Description WordPress does not correctly handle some malformed relative URL paths while resolving them in some cases, which could allow users with Contributor-level access and above to trigger an uncontrolled loop and cause a denial of service through server worker exhaustion...

VulnCheck KEV: CVE-2026-94504

Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the...

CVE-2026-104757: Incorrect Privilege Assignment

Editor Privilege Escalation in Import and export users and customers = 2.5.5 versions...

The vulnerability of Visual Studio Code’s source editor lies in its insufficient checking of unusual or exceptional states, allowing attackers to circumvent security restrictions.

The vulnerability of Visual Studio Code’s source editor is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions remotely...

The vulnerability of Visual Studio Code’s source editor, related to the use of a name with an incorrect reference, allows attackers to gain unauthorized access to protected information.

The vulnerability of Visual Studio Code’s source editor is related to the use of a name with an incorrect reference. Exploiting this vulnerability could allow an attacker, working remotely, to gain unauthorized access to protected information...

The vulnerability of Visual Studio Code’s source editor, related to deficiencies in HTTP request processing, allows attackers to circumvent security restrictions.

The vulnerability of Visual Studio Code’s source editor is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to bypass security restrictions remotely...

The vulnerability of Visual Studio Code’s source editor, related to the occurrence of interpretation conflicts, allows attackers to circumvent security restrictions.

The vulnerability of Visual Studio Code’s source editor is related to the occurrence of interpretation conflicts. Exploiting this vulnerability allows a malicious actor to bypass security restrictions remotely...

The vulnerability of Visual Studio Code’s source editor, related to the manipulation of intersite requests, allows a hacker to circumvent security restrictions.

The vulnerability of Visual Studio Code’s source editor is related to the manipulation of intersite requests. Exploiting this vulnerability allows a malicious actor to bypass security restrictions remotely...

EUVD-2026-89336

simple-git: VISUAL editor environment variable is omitted from unsafe editor detection...

CVE-2026-105678

Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. This issue is fixed in version 6.64.0...

CVE-2026-105692

The open-source design and prototyping platform Penpot contains an IDOR vulnerability in its delete-share-link RPC before version 2.18.0 . The application fails to verify if a caller is the creator of a share-link or possesses administrator authority, checking only if the caller can edit the pare...