Lucene search
+L

2902 matches found

EUVD
EUVD
added 2026/08/12 6:00 a.m.12 views

EUVD-2026-57073

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses...

6.5CVSS5.2AI score0.0027EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/08/12 12:00 a.m.10 views

PT-2026-71000

Name of the Vulnerable Software and Affected Versions Eventin WordPress plugin versions prior to 4.1.20 Description Insufficient access restrictions to individual order records allow users with contributor-level permissions or higher to access other customers' order data, including personal...

4.3CVSS5.2AI score0.00185EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/08/12 12:00 a.m.6 views

PT-2026-71177

Name of the Vulnerable Software and Affected Versions Apache Allura versions prior to 1.19.1 Description An Insecure Direct Object Reference IDOR exists due to missing permission checks for multiple Artifact types. IDOR is a type of access control vulnerability that occurs when an application...

6.5CVSS5.3AI score0.00343EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/08/12 12:00 a.m.8 views

PT-2026-71015

The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored...

5.3CVSS5.2AI score0.00211EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/08/12 12:00 a.m.10 views

PT-2026-71300

Name of the Vulnerable Software and Affected Versions IBM Security Verify Access versions 10.0 through 10.0.9.2 IBM Verify Identity Access versions 11.0 through 11.0.3 IBM Verify Identity Access Container versions 11.0 through 11.0.3 IBM Security Verify Access Container versions 10.0 through...

8.1CVSS5.1AI score0.00248EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/08/12 12:00 a.m.16 views

PT-2026-71245

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Insufficient publish-access checks in the 'getBlockAttrs' and 'batchGetBlockAttrs' endpoints allow attackers to retrieve block attributes from protected documents. By sending POST requests containing...

6.9CVSS5.7AI score0.00237EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
added 2026/08/12 12:00 a.m.10 views

PT-2026-71196

The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving container service configurations to Azure Kubernetes Service. In version 2.1.2 and earlier, a security vulnerability was identified in the...

8.7CVSS5.4AI score0.00677EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/11 9:17 p.m.10 views

CVE-2026-19579

Snipe-IT before 8.6.0 contains an authorization bypass insecure direct object reference in the asset checkout-request cancellation endpoint. The cancelbyadmin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any...

5.4CVSS0.00279EPSS
SaveExploits1References2
EUVD
EUVD
added 2026/08/11 8:25 p.m.14 views

EUVD-2026-56949

Snipe-IT before 8.6.0 contains an authorization bypass insecure direct object reference in the asset checkout-request cancellation endpoint. The cancelbyadmin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any...

5.4CVSS5.3AI score0.00279EPSS
SaveExploits1References2
Cvelist
Cvelist
added 2026/08/11 8:25 p.m.35 views

CVE-2026-19579 Snipe-IT Checkout Request Cancellation IDOR

Snipe-IT before 8.6.0 contains an authorization bypass insecure direct object reference in the asset checkout-request cancellation endpoint. The cancelbyadmin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any...

5.4CVSS0.00279EPSS
SaveExploits1References2
CVE
CVE
added 2026/08/11 8:25 p.m.38 views

CVE-2026-19579

Affected software: Snipe-IT

5.4CVSS5.3AI score0.00279EPSS
SaveExploits1References2Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/08/11 8:25 p.m.12 views

CVE-2026-19579

Snipe-IT before 8.6.0 contains an authorization bypass insecure direct object reference in the asset checkout-request cancellation endpoint. The cancelbyadmin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any...

5.4CVSS5.3AI score0.00279EPSS
SaveExploits1References3
OSV
OSV
added 2026/08/11 8:25 p.m.21 views

CVE-2026-19579 Snipe-IT Checkout Request Cancellation IDOR

Snipe-IT before 8.6.0 contains an authorization bypass insecure direct object reference in the asset checkout-request cancellation endpoint. The cancelbyadmin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any...

5.3CVSS5.4AI score
SaveExploits0References4
NVD
NVD
added 2026/08/11 7:18 p.m.12 views

CVE-2026-73221

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with the Worker role can use predictable task-based request IDs with the lambda request retrieve and destroy endpoints to view automatic annotation requests for tasks or jobs t...

5.3CVSS0.00246EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/08/11 6:22 p.m.8 views

CVE-2026-73221

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 until 2.72.0, a user with the Worker role can use predictable task-based request IDs with the lambda request retrieve and destroy endpoints to view automatic annotation requests for tasks or jobs t...

5.3CVSS5.3AI score0.00246EPSS
SaveExploits0References5Affected Software1
NVD
NVD
added 2026/08/11 4:17 p.m.24 views

CVE-2026-73068

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.207, the ToolJet Database HTTP API in server/src/modules/tooljet-db/controller.ts authorizes operations against the :organizationId URL path value without...

5.9CVSS0.0028EPSS
SaveExploits0References4
NVD
NVD
added 2026/08/11 4:17 p.m.19 views

CVE-2026-56720

CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint...

5.3CVSS0.00251EPSS
SaveExploits0References4
NVD
NVD
added 2026/08/11 4:17 p.m.11 views

CVE-2026-56721

CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference IDOR that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parameter confusion flaw between the authorization filter and action...

8.8CVSS0.00361EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2026/08/11 3:48 p.m.8 views

CVE-2026-56721 CamaleonCMS 2.9.2 Privilege Escalation via Parameter Confusion in UsersController

CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference IDOR that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parameter confusion flaw between the authorization filter and action...

8.8CVSS5.2AI score0.00361EPSS
SaveExploits0References4
CVE
CVE
added 2026/08/11 3:48 p.m.31 views

CVE-2026-56721

CVE-2026-56721 affects CamaleonCMS

8.8CVSS5.3AI score0.00361EPSS
SaveExploits0References4
Rows per page
Query Builder