68763 matches found
Vulnerabilities in Adobe Experience Manager
Adobe has identified several vulnerabilities in Adobe Experience Manager. These vulnerabilities include an absence of authentication at a critical function, allowing unauthorized actions to occur without user interaction. Additionally, there is a Server-Side Request Forgery SSRF vulnerability tha...
CVE-2026-15982
The CVE-2026-15982 entry describes a Privilege Escalation flaw in the Aimogen Pro WordPress plugin (<= 2.8.4). The root cause is a missing capability check in the function aiomatic_call_google_ai_function, which allows unauthenticated attackers to use the aimogen_wp_god_mode tool to clear func...
CVE-2026-15982 Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.4 - Unauthenticated Privilege Escalation via 'aiomatic_call_google_ai_function'
The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.8.4. This is due to due to a missing capability check on the 'aiomaticcallgoogleaifunction' function. This makes ...
CVE-2026-15982 Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.4 - Unauthenticated Privilege Escalation via 'aiomatic_call_google_ai_function'
The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.8.4. This is due to due to a missing capability check on the 'aiomaticcallgoogleaifunction' function. This makes ...
PT-2026-60744
GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a by default six-character string. The built-in rand function is...
The vulnerability of Honeywell IQ4 programmable logic controllers’ microprogramming software lies in the lack of authentication for critical functions, allowing attackers to gain full access to the device.
The vulnerability of the microprogrammed software in Honeywell IQ4 programmable logic controllers is related to the absence of authentication for a critical function. Exploiting this vulnerability can allow an attacker operating remotely to gain full access to the device...
The vulnerability of Rockwell Automation’s communication adapter software 1715-AENTR allows a intruder to gain unauthorized access to protected information.
The vulnerability of Rockwell Automation’s communication adapter software 1715-AENTR relates to the absence of authentication for a critical function. Exploiting this vulnerability could allow an intruder, operating remotely, to gain unauthorized access to protected information...
The vulnerability of the Ancillary Function Driver for WinSock in Windows operating systems allows attackers to increase their privileges.
The vulnerability of the Ancillary Function Driver for WinSock operating systems in Windows is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...
ROS-20260717-73-0033
The vulnerability of Google Chrome’s Navigation function is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions using a specially created HTML page...
PT-2026-60836
A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.25.2. Affected by this issue is the function Star.text to image/NetworkRenderStrategy.render of the file astrbot/core/star/base.py of the component T2I Feature. The manipulation leads to cross site scripting. The attack is...
PT-2026-60768
A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. Impacted is the function list/remove of the file tools/tool cron.go of the component cron Chat Tool. The manipulation results in missing authorization. The attack may be performed from remote. The exploit has been released to th...
VulnCheck KEV: CVE-2026-46442
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When...
CVE-2026-15997
Out-of-bounds write vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM allows Overflow Buffers. This vulnerability is associated with program files https://github.Com/bcgit/bc-lts-java/blob/main/nativec/arm/sha/shake.C,...
Improper Handling of Insufficient Permissions or Privileges
Overview Affected versions of this package are vulnerable to Improper Handling of Insufficient Permissions or Privileges via the DefineFunctionStatement.executeSimple path in engine/src/main/java/com/arcadedb/query/sql/parser/DefineFunctionStatement.java. An attacker can execute arbitrary...
ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DEFINE FUNCTION ... LANGUAGE js
The GHSA-48qw-824m-86pr hardening added a checkPermissionsOnDatabaseUPDATESECURITY gate on the polyglot engine PolyglotQueryEngine.java:112-114,126,176,199, but only there. The SQL route to JavaScript never touches it: DefineFunctionStatement.executeSimple DefineFunctionStatement.java:37-100,...
GHSA-VWJC-V7X7-CM6G ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DEFINE FUNCTION ... LANGUAGE js
The GHSA-48qw-824m-86pr hardening added a checkPermissionsOnDatabaseUPDATESECURITY gate on the polyglot engine PolyglotQueryEngine.java:112-114,126,176,199, but only there. The SQL route to JavaScript never touches it: DefineFunctionStatement.executeSimple DefineFunctionStatement.java:37-100,...
Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container
Summary Nuclio Dashboard exposes POST /api/functions without authentication by default NOP auth mode. The spec.handler field e.g., mymodule:myfunction is parsed by functionconfig.ParseHandler which splits on : only — no path validation is applied to the module portion. During function build,...
Missing Authentication for Critical Function
Overview oncall is an Oncall is a calendar tool designed for scheduling and managing on-call shifts Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the plugin install endpoint when sending a POST request with hardcoded default stackid and orgid...
CVE-2026-46514
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fmresetpassword in Tools/ResetPassword.php:48-53 returned a plaintext password and fmaddextension in Tools/AddExtension.php:172 returned a plaintext secret; Frogman.class.php:2207-2211 used auditOutcome to JSON-encode...
