58620 matches found
GHSA-WG36-WVJ6-R67P
creationtimestamp| type| source ---|---|--- 2026-04-15 23:27:35+00:00| seen| Telegram/ajbOyvFAewWZ2L70l5GRQuj2wRnDYaN4zfpEHfJh7NMuY...
CVE-2026-4880 Barcode Scanner (+Mobile App) <= 1.11.0 - Unauthenticated Privilege Escalation via Insecure Token Authentication
The Barcode Scanner +Mobile App – Inventory manager, Order fulfillment system, POS Point of Sale plugin for WordPress is vulnerable to privilege escalation via insecure token-based authentication in all versions up to, and including, 1.11.0. This is due to the plugin trusting a user-supplied...
GHSA-558G-H753-6M33
creationtimestamp| type| source ---|---|--- 2026-04-15 23:25:44+00:00| published-proof-of-concept| Telegram/M6EVzZe60-ZK2hxHMbXVzi0icuKFKnAtI2GiQ0rZVKguBtE...
CVE-2026-34632
creationtimestamp| type| source ---|---|--- 2026-04-15 23:25:44+00:00| published-proof-of-concept| Telegram/M6EVzZe60-ZK2hxHMbXVzi0icuKFKnAtI2GiQ0rZVKguBtE 2026-04-22 15:30:05+00:00| seen| https://infosec.place/objects/e937704a-fd88-4421-b9d6-cdadb714a102...
GHSA-234R-45M2-W6CV
creationtimestamp| type| source ---|---|--- 2026-04-15 23:25:44+00:00| published-proof-of-concept| Telegram/M6EVzZe60-ZK2hxHMbXVzi0icuKFKnAtI2GiQ0rZVKguBtE...
CVE-2026-4949
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.16.12. This is due to the 'processcheckout' function not properly enforcing...
CVE-2026-4949 ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.16.12. This is due to the 'processcheckout' function not properly enforcing...
CVE-2026-4949 ProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.16.12. This is due to the 'processcheckout' function not properly enforcing...
CVE-2026-41273
creationtimestamp| type| source ---|---|--- 2026-04-15 21:43:37+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-6f7g-v4pp-r667 2026-04-23 21:26:47+00:00| seen| Telegram/lUzHwqY45MHoOS5UDHqr6saeA9vYjttsYdPIjTNMATUwM 2026-04-25 03:00:12+00:00| seen|...
Incorrect Permission Assignment for Critical Resource
Overview Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource in the Correlations feature due to a backward compatibility condition that allows records with orgid=0 to be accessed across organizations. An attacker with datasource management...
CVE-2026-33708
Chamilo LMS is a learning management system. Prior to 1.11.38, the getuserinfofromusername REST API endpoint returns personal information email, first name, last name, user ID, active status of any user to any authenticated user, including students. There is no authorization check. This...
CVE-2026-32087
Heap-based buffer overflow in Function Discovery Service fdwsd.dll allows an authorized attacker to elevate privileges locally...
Always-Incorrect Control Flow Implementation
Overview Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation due to an inverted time comparison in the OIDC JWKS and token cache processes. An attacker can cause expired tokens to be reused or force repeated network requests to the OIDC provider by...
Insufficient Session Expiration
Overview Affected versions of this package are vulnerable to Insufficient Session Expiration in the DSF FHIR and BPE Servers with enabled OIDC authentication due to the lack of session timeout enforcement in OIDC browser sessions. An attacker can gain unauthorized access to a user's session by...
Insufficient Session Expiration
Overview Affected versions of this package are vulnerable to Insufficient Session Expiration in the DSF FHIR and BPE Servers with enabled OIDC authentication due to the lack of session timeout enforcement in OIDC browser sessions. An attacker can gain unauthorized access to a user's session by...
GHSA-GJ7P-595X-QWF5 Data Sharing Framework is Missing Session Timeout for OIDC Sessions
Affected Components DSF FHIR Server with enabled OIDC authentication. DSF BPE Server with enabled OIDC authentication. Summary OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired. Impact If...
Data Sharing Framework is Missing Session Timeout for OIDC Sessions
Affected Components DSF FHIR Server with enabled OIDC authentication. DSF BPE Server with enabled OIDC authentication. Summary OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired. Impact If...
CVE-2026-6303
Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
