WordPress Core - Post Author Email Disclosure

WordPress Core is vulnerable to Sensitive Information Exposure in versions between 4.7.0 and 6.3.1 via the User REST endpoint. While the search results do not display user email addresses unless the requesting user has the 'listusers' capability, the search is applied to the useremail column. id:...

Label Studio - Cross-Site Scripting

Versions prior to 1.9.2 have a cross-site scripting XSS vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the website. id: CVE-2023-47115 info: name: Label Studio - Cross-Site Scripting author: isaca...

AstrBot <= 4.22.1 - Command Injection

AstrBot versions up to and including 4.22.1 contain a command injection vulnerability in the MCP server configuration endpoint. The /api/tools/mcp/add endpoint accepts arbitrary command and args fields that are passed directly to subprocess execution during the connection test, without any...

LearnPress < 4.3.7 - Information Disclosure

LearnPress WordPress plugin 4.3.7 contains an information disclosure vulnerability caused by missing capability checks on a REST endpoint, letting unauthenticated visitors retrieve sensitive user role and capability data via crafted requests. id: CVE-2026-8383 info: name: LearnPress 4.3.7 -...

Mesop AI Sandbox <= 1.2.2 - Remote Code Execution

Mesop = 1.2.2 contains an unrestricted remote code execution caused by unauthenticated ingestion and execution of base64-encoded Python code in the /exec-py endpoint of ai/testing module, letting attackers execute arbitrary commands on the host, exploit requires HTTP access to the server. id:...

Dgraph <= 25.3.2 - Admin Token Disclosure

Dgraph = 25.3.2 contains an information disclosure caused by unauthenticated access to the /debug/vars endpoint , which publishes the cmdline variable including the --security token= flag, letting unauthenticated remote attackers retrieve the admin token and access admin-only endpoints, exploit...

Uptime-Kuma < v1.23.0 - Improper Access Control

Uptime-Kuma before v1.23.0 is vulnerable to an information disclosure issue due to missing authorization on the /api/badge/1/ping/24 endpoint. An unauthenticated attacker can access this endpoint to leak ping statistics, such as average ping and ping history, for existing monitors without needing...

Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS

Adminer = 5.4.1 contains a denial of service caused by lack of origin validation in version check endpoint, letting attackers trigger server errors via crafted POST requests, exploit requires no special privileges. id: CVE-2026-25892 info: name: Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent Do...

Concrete CMS <= 9.5.0 - Unauthenticated Conversation Message Disclosure (IDOR)

Concrete CMS = 9.5.0 contains an IDOR caused by insufficient access control in /ccm/frontend/conversations/messagedetail endpoint, letting unauthenticated attackers enumerate conversation messages and attachments. id: CVE-2026-8237 info: name: Concrete CMS = 9.5.0 - Unauthenticated Conversation...

CVE-2026-74682

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs dataepsetparams sizes each URB transfer buffer before it adds the Format Type II transfer delimiter: u-packets = urbpacks; u-buffersize = maxsize u-packets; if fmt-fmttype ==...

CVE-2026-74642

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in umptoendpoint caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the...

EUVD-2026-64369

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs dataepsetparams sizes each URB transfer buffer before it adds the Format Type II transfer delimiter: u-packets = urbpacks; u-buffersize = maxsize u-packets; if fmt-fmttype ==...

EUVD-2026-64579

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in umptoendpoint caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the...

CVE-2026-74642

CVE-2026-74642 is a Use-After-Free (UAF) vulnerability in the Linux kernel's ALSA USB subsystem , specifically in the handling of MIDI 2.0 (UMP) endpoints . A prior fix for a UAF in ump_to_endpoint() inadvertently introduced a second UAF: the code dereferences the UMP endpoint object in a delayed...

EUVD-2026-64321

Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik 4.7.2 - The DeleteComment endpoint did not perform any access checks...

EUVD-2026-64318

Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik 4.7.2 - The onUpdateComment endpoint did not perform any access checks...

EUVD-2026-64317

Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik 4.7.2 - The onGetEmail endpoint did not perform any access checks...

CVE-2026-76608

Fabrik is a Joomla extension that provides form and database functionality. In versions prior to 4.7.2 , the onGetEmail endpoint lacked any access control checks, allowing an unauthenticated attacker to disclose the email address of any commenter. This constitutes an information disclosure vulner...

EUVD-2026-64275

The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicatepost function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has editothersposts capability before...

CVE-2026-4244

The Post Duplicator plugin for WordPress (all versions up to and including 3.0.11 ) is vulnerable to unauthorized data modification due to a missing capability check in the duplicate_post() function. The function does not verify that the caller holds the edit_others_posts capability before accept...