CVE-2026-14823

CVE-2026-14823 relates to the WordPress plugin Event Tickets and Registration prior to version 5.29.0.1. The issue is an authorization flaw in seating actions (IDOR-like behavior) that allows users with contributor-level access and above to overwrite the seating layout, ticket inventory, and atte...

CVE-2026-14823 Event Tickets < 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification via IDOR

The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with contributor-level access and above to overwrite the seating layout, ticket inventory, and attendee seat assignments of events they do not...

CVE-2026-14822

The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders...

CVE-2026-14823

The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with contributor-level access and above to overwrite the seating layout, ticket inventory, and attendee seat assignments of events they do not...

CVE-2026-14822

CVE-2026-14822 affects the WordPress plugin Event Tickets and Registration prior to version 5.29.0.1. The issue is an missing authorization check on an order-management REST endpoint, allowing unauthenticated users to change the status of existing orders. The CVSS v3.1 base score is 5.3 (Medium) ...

CVE-2026-13604 Pixelavo < 1.5.4 - Unauthenticated Facebook CAPI Event Injection via pixelavo_event AJAX

The Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated AJAX action, gated only by a nonce that it emits publicly on every front-end page, that forwards client-supplied event data to the configured Facebook Conversions API using the administrator's stored access token. This allows...

WordPress Pixelavo plugin < 1.5.4 - Unauthenticated Facebook CAPI Event Injection vulnerability

Unauthenticated Facebook CAPI Event Injection vulnerability discovered by Md Amin Ullah Sheikh in WordPress Plugin Pixelavo versions 1.5.4...

CVE-2026-51281

creationtimestamp| type| source ---|---|--- 2026-08-01 02:53:58+00:00| seen| https://gist.github.com/programmervuln/4a4670ae02340631b9a5e3eaddece53a...

CVE-2026-9044

creationtimestamp| type| source ---|---|--- 2026-08-01 00:14:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/bfcbsocxijx5t 2026-08-01 21:13:58+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117022316193952123 2026-08-06 03:22:18+00:00| seen|...

CVE-2026-8347

creationtimestamp| type| source ---|---|--- 2026-07-31 22:00:02+00:00| seen| Telegram/CaZ2R0Efl1eBRVqO-sOZ66dFvtq0HENlFRwe45W-Oe0iQ 2026-08-01 00:00:10+00:00| seen| Telegram/CaZ2R0Efl1eBRVqO-sOZ66dFvtq0HENlFRwe45W-Oe0iQ...

CVE-2026-15969

creationtimestamp| type| source ---|---|--- 2026-07-31 19:02:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxndlbvkx2h 2026-08-05 14:27:15+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3msdqcbbsp726 2026-08-06 03:18:46+00:00| seen|...

GHSA-MJ3G-7XCC-X4VH

creationtimestamp| type| source ---|---|--- 2026-07-31 18:32:14+00:00| seen| https://gist.github.com/alon710/3afa9bbe175e1dfd1649cd2081ad6eb5...

CVE-2026-67822

creationtimestamp| type| source ---|---|--- 2026-07-31 18:12:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5cbbr7n7dy7lz 2026-07-31 19:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxnh5mze42a 2026-08-08 23:28:21+00:00| seen|...

abrt: ChownProblemDir succeeds during active post-create event processing due to inadequate locking

A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DDOPENREADONLY and calls ddchown to change ownership of all files to the caller's uid, succeeding even while post-create event handlers hold a write lock. This allows ...

abrt: ChownProblemDir succeeds during active post-create event processing due to inadequate locking

A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DDOPENREADONLY and calls ddchown to change ownership of all files to the caller's uid, succeeding even while post-create event handlers hold a write lock. This allows ...

abrt: ChownProblemDir succeeds during active post-create event processing due to inadequate locking

A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DDOPENREADONLY and calls ddchown to change ownership of all files to the caller's uid, succeeding even while post-create event handlers hold a write lock. This allows ...

CVE-2026-17059

creationtimestamp| type| source ---|---|--- 2026-07-31 17:04:16+00:00| seen| https://bsky.app/profile/thedailytechfeed.com/post/3mrxgquksow2h...

CVE-2026-52855

creationtimestamp| type| source ---|---|--- 2026-07-31 17:04:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxgqloluu2j 2026-07-31 17:54:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2cyzi3feyud55 2026-07-31 19:49:55+00:00| seen|...

CVE-2026-18141

A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible EDA. An unauthenticated remote attacker can bypass mutual Transport Layer Security mTLS authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP...

CVE-2026-18141

A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible EDA. An unauthenticated remote attacker can bypass mutual Transport Layer Security mTLS authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP...