67690 matches found
CVE-2026-76216 Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing
Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete vict...
CVE-2026-76216
Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete vict...
MINI-G33P-575P-43VV
Bulletin has no description...
CVE-2026-73354
The WordPress SimplyRETS Real Estate IDX plugin (≤ 3.2.8) allows unauthenticated reflected/stored XSS due to insufficient input sanitization. CVSS 7.1 (HIGH) reflects network exposure requiring user interaction. No in-the-wild exploitation is reported. PatchStack notes a fix is available; upgrade...
WordPress Database for Contact Form 7, WPforms, Elementor forms plugin < 1.5.5 - Authenticated SQL Injection via id Parameter vulnerability
Authenticated SQL Injection via id Parameter vulnerability discovered by Andrew Lyons in WordPress Plugin Contact Form Entries versions 1.5.5...
CVE-2026-76049 SourceCodester Simple Online Food Ordering System ajax.php save_menu sql injection
A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=savemenu. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...
EUVD-2026-62227
A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=savemenu. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...
PT-2026-80652
Summary The fix for GHSA-v2wp-frmc-5q3v added validate acme url to reject acme url values not in ACME DIRECTORY HOST ALLOWLIST, but the validation is only called at authority creation time POST. The authority update endpoint PUT /api/1/authorities/ accepts and stores arbitrary options -- includin...
PT-2026-78398
Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.4.1 Description A principal-type confusion occurs when LinkSharing principals with id N are treated as user principals with users.id == N due to three permission checks lacking type guards. This allows attackers...
PT-2026-80651
Summary Repo under test: https://github.com/Netflix/lemur PUT /api/1/certificates//revoke authorizes the caller against the Lemur database row creator == current user, or CertificatePermission over the row's roles rather than the underlying CA-side certificate identity. Separately, POST...
PT-2026-78266
A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of the file /admin/ajax.php?action=delete menu. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been mad...
PT-2026-80653
Summary The ACME client used to issue certificates from Let's Encrypt / Google Public CA / private ACME CAs connects to an acme url, then issues requests to URLs that the ACME server returns in its directory/order/authorization/finalize responses - this is the classic ACME-client SSRF RFC 8555...
PT-2026-80647
Summary Lemur's destination read endpoints -- GET /api/1/destinations and GET /api/1/destinations/ -- return the full set of stored plugin option values to any authenticated user, with no authorization check and no redaction of secret-bearing options. The sibling write endpoints POST/PUT/DELETE a...
CVE-2026-53548: Improper Authorization
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.6.1, the GET /host/db/host/:id/password endpoint in src/backend/database/routes/host.ts accepts an authenticated user's numeric host ID and the field=password or...
CVE-2026-76386: Cleartext Storage of Sensitive Information
In versions below 3.2.2 of the Zoom app for Splunk SOAR, a user who holds a role with permission to run actions could expose meeting and personal meeting ID passwords by invoking one of the create meeting, update meeting, or update user settings actions, because the affected password and...
CVE-2026-76050: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of the file /admin/ajax.php?action=deletemenu. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been made...
CVE-2026-76049: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=savemenu. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...
CVE-2026-76216: Authorization Bypass Through User-Controlled Key
Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete vict...