68305 matches found
CVE-2026-15346
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'categoryid' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...
PyJWT: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)
...
CVE-2026-15346
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'categoryid' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...
CVE-2026-15346
The CVE-2026-15346 entry concerns the VikBooking Hotel Booking Engine & PMS WordPress plugin, affected up to version 1.8.13. The vulnerability is a Reflected Cross-Site Scripting issue in the category_id parameter caused by insufficient input sanitization and output escaping. The impact is that u...
EUVD-2026-48528
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'categoryid' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...
CVE-2026-45820
creationtimestamp| type| source ---|---|--- 2026-07-24 02:48:49+00:00| seen| https://bsky.app/profile/opsmatters.com/post/3mredorzn2s2t 2026-08-04 04:47:06+00:00| seen| https://bsky.app/profile/pmloik.bsky.social/post/3msa7gdsqch2o 2026-09-04 12:37:18+00:00| seen|...
CVE-2026-11354 Participants Database <= 2.7.8.3 - Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure via 'id' Parameter
The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthenticated attackers to overwrite arbitrary participant records by numeric ID and redirect the...
CVE-2026-11354
The CVE-2026-11354 entry affects the WordPress plugin Participants Database (versions up to 2.7.8.3). The vulnerability is a Missing Authorization issue via the id parameter, allowing unauthenticated attackers to overwrite arbitrary participant records and redirect the private_id‑bearing record-a...
CVE-2026-11354 Participants Database <= 2.7.8.3 - Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure via 'id' Parameter
The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthenticated attackers to overwrite arbitrary participant records by numeric ID and redirect the...
ECHO-AF27-3CF7-5F51
Bulletin has no description...
CVE-2026-56160
creationtimestamp| type| source ---|---|--- 2026-07-24 00:24:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mre3lwoaig2a 2026-07-24 02:25:24+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mrecev6bhf2p 2026-07-24 02:25:26+00:00| seen|...
PT-2026-64224
The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthenticated attackers to overwrite arbitrary participant records by numeric ID and redirect the priva...
PT-2026-67610
Summary The Budibase Worker service exposes a public, unauthenticated API endpoint GET /api/global/users/tenant/:id that returns sensitive user information including tenantId, userId, email, and ssoId. The endpoint is registered in the PUBLIC ENDPOINTS list with a TODO comment acknowledging it...
PT-2026-64439
Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.5 through 0.9.9 Description An authenticated user can overwrite the content of messages in channels they do not belong to, including private and direct message channels. This occurs when a chat completion request is sen...
PT-2026-67478
Am I affected? You are affected if your application registers the @better-auth/scim plugin and lets authenticated users generate SCIM tokens. The default canGenerateToken policy was affected, and custom policies were affected when they did not reject provider IDs already used by other account...
CVE-2026-11354: Missing Authorization
The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthenticated attackers to overwrite arbitrary participant records by numeric ID and redirect the...
PT-2026-67309
Name of the Vulnerable Software and Affected Versions @better-auth/stripe versions 1.4.11 through 1.6.20 @better-auth/stripe versions 1.7.0-beta.0 through 1.7.0-beta.9 Description An authorization bypass exists in organization subscription actions. The issue occurs because the middleware validate...
PT-2026-64286
Name of the Vulnerable Software and Affected Versions Parse Server versions 9.0.0 through 9.10.0-alpha.4 Parse Server versions 8.2.2 through 8.6.85 Description GraphQL validation error messages reveal the names of required custom input fields even when public introspection is disabled via the...
CVE-2026-16764
The CVE pertains to OWASP DefectDojo 2.59.0, where the UserSerializer in dojo/api_v2/serializers.py mishandles the is_staff argument, enabling improper privilege management. This issue can be exploited remotely; an exploit exists publicly. Remediation is to upgrade to DefectDojo 2.58.3 or 3.0.0, ...