3265 matches found
EUVD-2026-85060
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read...
WordPress WC Fields Factory plugin < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content Disclosure vulnerability
Contributor+ Arbitrary Post Cloning and Private Content Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin WC Fields Factory versions 4.1.11...
CVE-2026-93508
The WC Fields Factory WordPress plugin, in versions prior to 4.1.11 , is vulnerable to unauthorized access because it fails to properly restrict its field-management AJAX action . This flaw allows authenticated users with Subscriber-level access or higher to perform unauthorized actions, includin...
CVE-2026-93507
The WC Fields Factory WordPress plugin (versions before 4.1.11 ) is vulnerable to an authorization bypass because it fails to properly restrict access to or verify a nonce for a post-cloning action. This flaw allows users with Contributor-level privileges and above to duplicate arbitrary posts, r...
WordPress WC Fields Factory plugin < 4.1.11 - Subscriber+ Arbitrary Post Meta Manipulation vulnerability
Subscriber+ Arbitrary Post Meta Manipulation vulnerability discovered by Farid Narimanov in WordPress Plugin WC Fields Factory versions 4.1.11...
CVE-2026-93507 WC Fields Factory < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content Disclosure
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read...
EUVD-2026-85061
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...
CVE-2026-93508: Missing Authorization
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...
CVE-2026-96756: Improper Control of Generation of Code
orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the...
CVE-2026-93507: Missing Authorization
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read...
CVE-2026-45723
Omni (SideroLabs), a Kubernetes management platform, is vulnerable to same-host path traversal via the managementServer.CreateSchematic gRPC endpoint. The caller-controlled TalosVersion field is passed unsanitized to imageFactoryClient.OverlaysVersions, where url.URL.JoinPath resolves ../ sequenc...
CVE-2026-91988: Cleartext Transmission of Sensitive Information
atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spawned as local subprocesses by...
Astra Linux – Vulnerability in Axis
UNSUPPORTED WHEN ASSIGNED When integrating Apache Axis 1.x in an application, it might not have been obvious that using “ServiceFactory.getService” could lead to potentially dangerous operations, such as LDAP queries. Passing untrusted input to this API method could expose the application to DoS,...
CVE-2026-90579: Missing Authentication for Critical Function
A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. This affects the function authorizehttpkey of the file core/cat/factory/customauthhandler.py. The manipulation of the argument userid leads to missing authentication. The attack may be initiated remotely. The exploit h...
CVE-2025-15679
Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515...
CVE-2025-15679 BMC root account active without password on BullSequana XH3406 and XH3515
Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515...
CVE-2025-15679 BMC root account active without password on BullSequana XH3406 and XH3515
Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515...
EUVD-2025-210890
Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515...
CVE-2025-15679
CVE-2025-15679 affects the BMC (Baseboard Management Controller) root account , which can become active without a password under certain circumstances such as a reset to factory default operation. This grants unauthenticated local access with HIGH impact on confidentiality, integrity, and availab...
