10729 matches found
CVE-2026-50281
Craft CMS vulnerability CVE-2026-50281 affects versions 5.7.0 through 5.9.20. A mass-assignment flaw in the bulk-duplicate element action allows an attacker who can duplicate their own entries to submit an arbitrary id via the newAttributes parameter. The duplication flow clones the source elemen...
CVE-2026-50281
Craft CMS is a content management system CMS. Versions 5.7.0 and above, prior to 5.9.21 contain a mass-assignment flaw in the bulk-duplicate element action. An attacker who is only able to duplicate their own entires can submit an arbitrary id through the newAttributes request parameter. The...
CVE-2026-50281 Craft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elements
Craft CMS is a content management system CMS. Versions 5.7.0 and above, prior to 5.9.21 contain a mass-assignment flaw in the bulk-duplicate element action. An attacker who is only able to duplicate their own entires can submit an arbitrary id through the newAttributes request parameter. The...
MINI-79W6-RWP9-C3F7
Bulletin has no description...
MINI-G76R-VG37-569W
Bulletin has no description...
MINI-C49X-9FXX-RG6P
Bulletin has no description...
MINI-QF85-7HRC-H2HX
Bulletin has no description...
MINI-HC95-WP2W-J6FP
Bulletin has no description...
MINI-FHGC-XRCG-PJVG
Bulletin has no description...
MINI-J446-46W4-PJ5F
Bulletin has no description...
MINI-G6X8-Q3VJ-6HPF
Bulletin has no description...
MINI-FP25-7WQP-CRCH
Bulletin has no description...
MINI-QHFC-6H7F-HMXC
Bulletin has no description...
MINI-RP89-G2RV-M597
Bulletin has no description...
python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite
A flaw was found in pip, the package installer for Python. A remote attacker can exploit this vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially crafted entry-point names that use directory traversal or absolute paths. This allows pip to wri...
CGA-4FQ7-RQ3F-VQHP
Bulletin has no description...
MINI-JC2W-MG43-2M5R
Bulletin has no description...
jchain-static
jChain-Static Vulnerability Chain Playbook Generator for Pe...
CVE-2026-11578
The Fluent Forms WordPress plugin (versions before 6.2.5 ) is vulnerable to an IDOR (Insecure Direct Object Reference) flaw. The root cause is a failure to properly restrict the deletion of form submission entries to only those forms a restricted Manager is authorized to manage. If an administrat...