24389 matches found
GHSA-8HCV-X26H-MCGP
creationtimestamp| type| source ---|---|--- 2026-08-07 06:34:35+00:00| seen| https://gist.github.com/alon710/455dd27ab1381c77c49e252fb102cb9f...
CVE-2026-14205
CVE-2026-14205 affects the WP Events Manager WordPress plugin prior to 2.2.5. The vulnerability arises because the plugin does not validate the requested quantity when registering for paid events, and the price is computed from attacker-controlled quantity. This allows any authenticated user to c...
EUVD-2026-54202
The Event Booking Manager for WooCommerce Pro WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native non-WooCommerce checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows...
GHSA-6HR6-W5QG-QMWG
creationtimestamp| type| source ---|---|--- 2026-08-06 23:32:34+00:00| seen| https://gist.github.com/alon710/91251538851544e4ecb69dd2c9aa7a2b 2026-08-07 00:07:12+00:00| seen| https://gist.github.com/alon710/91251538851544e4ecb69dd2c9aa7a2b...
CVE-2026-11976
creationtimestamp| type| source ---|---|--- 2026-08-06 22:58:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msh5d24pcv2f...
CVE-2026-16067
The Event Booking Manager for WooCommerce Pro WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native non-WooCommerce checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows...
CVE-2026-71476
creationtimestamp| type| source ---|---|--- 2026-08-06 20:52:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msgwbqkenv23...
GHSA-265M-7826-WJQM Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass
Craft CMS has an authenticated remote code execution issue in the control panel element-search condition handling. Craft cleans the outer request-controlled condition array with Component::cleanseConfig, but Conditions::createCondition later decodes and merges the JSON string in condition.config...
CVE-2026-64640
creationtimestamp| type| source ---|---|--- 2026-08-06 19:53:56+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/fkstcuwaltx53 2026-08-08 23:32:42+00:00| seen| Telegram/C3q2vOTdkXA6iF-hzMGQrZVnDCfVSala-72eNVn5iLBkyI 2026-08-09 00:05:53+00:00| published-proof-of-concept|...
GHSA-X677-9FXG-V5C5
creationtimestamp| type| source ---|---|--- 2026-08-06 17:31:27+00:00| seen| https://gist.github.com/alon710/b0c30693be99e5683b1b7fa34bf1c9d1...
CVE-2026-16067 Event Booking Manager for WooCommerce (Pro) < 5.0.3 - Unauthenticated Payment Bypass via Client-Controlled Ticket Price
The Event Booking Manager for WooCommerce Pro WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native non-WooCommerce checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows...
CVE-2026-16067
The CVE concerns the Event Booking Manager for WooCommerce (Pro) WordPress plugin, affected versions prior to 5.0.3. The vulnerability arises because the plugin does not validate the ticket price on the server during its native checkout, trusting the per-ticket price supplied by the client. As a ...
GHSA-3CCP-42PG-HGV6
creationtimestamp| type| source ---|---|--- 2026-08-06 16:31:29+00:00| seen| https://gist.github.com/alon710/44f5ca1944b401eb63cfb2fdd265ca45...
CVE-2026-18276
Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the objectcls and objectpk values...
CVE-2026-66712
creationtimestamp| type| source ---|---|--- 2026-08-06 16:01:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msgfzmvka72b...
CVE-2026-66451
Unauthenticated Broken Authentication in WP Event SOlution = 4.1.9 versions...
EUVD-2026-54089
Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the objectcls and objectpk values...
CVE-2026-66451
Unauthenticated Broken Authentication in WP Event SOlution = 4.1.9 versions...