CVE-2026-1344

Tanium addressed an insecure file permissions vulnerability in Enforce Recovery Key Portal...

PT-2026-20289

The Kali Forms plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.8. This is due to the get items permissions check permission callback on the /kaliforms/v1/forms/id REST API endpoint only checking for the edit posts capability without...

PT-2026-20483

The 'Medical History' module in PHPGurukul Hospital Management System v4.0 contains an Insecure Direct Object Reference IDOR vulnerability. The application fails to verify that the requested 'viewid' parameter belongs to the currently authenticated patient. This allows a user to access the...

UBUNTU-CVE-2026-2604

A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or...

WordPress plugin Frontend User Notes 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2026-20437

UTT HiPER 810 / nv810v4 router firmware v1.5.0-140603 was discovered to contain insecure default credentials for the telnet service, possibly allowing a remote attacker to gain root access via a crafted script...

CVE-2025-70063

The Medical History module of PHPGurukul Hospital Management System v4.0 exposes an Insecure Direct Object Reference (IDOR) vulnerability. The application does not verify that the requested viewid belongs to the currently authenticated patient, allowing an attacker to enumerate viewid values to a...

PT-2026-20290

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.0 via the wpo ips edi save order customer peppol identifiers AJAX action due to missing capability checks and order ownership validatio...

Tanium Enforce Recovery Key Portal 安全漏洞

Tanium Enforce Recovery Key Portal is a component of the US-based Tanium company that allows access to disk encryption recovery keys. There is a security vulnerability in Tanium Enforce Recovery Key Portal, which stems from insecure file permissions. This vulnerability may allow attackers with...

PT-2026-20462

Missing authentication in /admin/student.php and /admin/teacher.php in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to obtain sensitive information including plaintext password field values via direct HTTP GET requests to these endpoints without a valid session...

CVE-2025-70998

CVE-2025-70998 affects UTT HiPER 810 / nv810v4 router firmware, version v1.5.0-140603. The telnet service ships with insecure default credentials, potentially allowing a remote attacker to gain root access via a crafted script. No exploitation details or mitigations are provided in the available ...

CVE-2025-70148

Missing authentication and authorization in printmembershipcard.php in CodeAstro Membership Management System 1.0 allows unauthenticated attackers to access membership card data of arbitrary users via direct requests with a manipulated id parameter, resulting in insecure direct object reference...

UTT HiPER 810 安全漏洞

UTT HiPER 810 is an intelligent broadband router produced by UTT Corporation. UTT HiPER 810 has a security vulnerability. This vulnerability stems from the use of insecure default credentials in the telnet service, which may allow remote attackers to obtain root access through a specially crafted...

WordPress plugin Kali Forms 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

CVE-2026-1344 Insecure file permissions in Enforce Recovery Key Portal

Tanium addressed an insecure file permissions vulnerability in Enforce Recovery Key Portal...

CVE-2026-1344

CVE-2026-1344 concerns an insecure file permissions vulnerability in Tanium’s Enforce Recovery Key Portal. The available documents consistently describe insecure file permissions as the underlying issue, with exposure to high confidentiality impact. Concrete details on affected versions, root cau...

CVE-2026-1344 Insecure file permissions in Enforce Recovery Key Portal

Tanium addressed an insecure file permissions vulnerability in Enforce Recovery Key Portal...

CVE-2026-1344

Tanium addressed an insecure file permissions vulnerability in Enforce Recovery Key Portal...

WordPress Frontend User Notes plugin <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Note Modification vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Arbitrary Note Modification vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin Frontend User Notes versions = 2.1.0...

GHSA-PPFX-73J5-FHXC Skill-scanner Unsecured Network Binding Vulnerability

Description: A vulnerability in the API Server of Skill Scanner could allow a unauthenticated, remote attacker to interact with the server API and either trigger a denial of service DoS condition or upload arbitrary files. This vulnerability is due to an erroneous binding to multiple interfaces. ...