31034 matches found
CVE-2026-77029 Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66
Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo 4.1.66...
CVE-2026-15580
creationtimestamp| type| source ---|---|--- 2026-08-21 11:55:28+00:00| seen| https://infosec.exchange/users/edwardk/statuses/117133366257032689 2026-08-21 11:55:58+00:00| seen| https://bsky.app/profile/e-kiledjian.bsky.social/post/3mtlpcvhj4s24 2026-08-21 13:00:40+00:00| seen|...
bramble v1.18.0-chromium
Bramble A password manager that keeps your secrets on your own devices. No account, no server holding your vault, no company to get breached and leak everything. You hold the vault, you hold the password, and that's it. Bramble runs where you do: Browser extension for Chromium browsers Brave,...
PT-2026-79381
Name of the Vulnerable Software and Affected Versions YOOtheme Pro versions 1.0.0 through 5.0.40 Description An SQL injection exists that allows any user with contributor-level privileges to inject arbitrary content into SQL queries. SQL injection is a technique where malicious SQL statements are...
PT-2026-79436
Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted...
PT-2026-79382
Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo 4.1.66...
PT-2026-79435
Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another customer's order id to copy their cart contents and address data into the attacker's session. The CSRF token was validated but...
CVE-2026-15580: Missing Origin Validation in WebSockets
vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3.49.6...
CVE-2026-77029: Cross-Site Request Forgery (CSRF)
Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo 4.1.66...
PT-2026-79383
Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo 4.1.66...
PT-2026-79378
Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files...
CVE-2026-58428
A flaw was found in Gitea. An authenticated remote attacker with repository write permission could bypass the attachment extension allowlist via the web release edit form. This vulnerability allows the attacker to rename existing release attachments to forbidden file extensions, potentially leadi...
Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
Summary HasUploadFields used via CrudTrait on Backpack-managed models and the withFiles uploader preserve the client-supplied file extension without validation. On installations using a public disk with php artisan storage:link, this allows an authenticated administrator to upload a file with a...
GHSA-8Q2W-PV9P-MJVC Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver
Summary HasUploadFields used via CrudTrait on Backpack-managed models and the withFiles uploader preserve the client-supplied file extension without validation. On installations using a public disk with php artisan storage:link, this allows an authenticated administrator to upload a file with a...
CVE-2026-77026
Convert Forms (by tassos.gr) for Joomla , versions below 5.2.5 , is affected by a client-controlled validation bypass. The front-end Submissions view did not enforce access control, allowing an unauthenticated visitor to list a form's submissions. The CVSS 4.0 base score is 6.9 (MEDIUM) , with a ...
CVE-2026-77026 Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5
Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions...
OESA-2026-3490 sqlite security update
SQLite is a C-language library that implements a small, fast, self-contained, high-reliability, full-featured, SQL database engine. SQLite is the most used database engine in the world. SQLite is built into all mobile phones and most computers and comes bundled inside countless other applications...
CVE-2026-76610
Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users...
CVE-2026-76610 Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65
Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users...