9917 matches found
PT-2026-84146
Name of the Vulnerable Software and Affected Versions Nokri - Job Board WordPress Theme versions prior to 1.6.7 Description Insufficient reset token validation in the nokri reset password function allows unauthenticated attackers to perform privilege escalation via account takeover. By providing ...
CVE-2026-84470: Missing Authorization
A flaw was found in Ansible Automation Platform's automation-controller AWX. The Bulk Job Launch API POST /api/v2/bulk/joblaunch/ authorizes the requested instancegroups with only a read-level permission check, whereas the standard single-job launch path requires use-level permission on the same...
CVE-2026-18550: Improper Privilege Management
The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the nokriresetpassword function, which allows empty attacker-supplied reset tokens to...
Alibaba Cloud Linux 3 : 0277: cups-filters (ALINUX3-SA-2026:0277)
The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0277 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-64612: A flaw was found in libcupsfilters...
PT-2026-84517
Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation-controller AWX affected versions not specified Description An authorization flaw exists in the Bulk Job Launch API endpoint 'POST /api/v2/bulk/job launch/'. The system performs only a read-level permissio...
North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales
Threat actors with ties to the Democratic People's Republic of Korea aka DPRK or North Korea have been observed seeking job opportunities beyond the information technology IT sector, with recent investigations identifying suspected workers employed in sales and marketing and the medical professio...
Langflow 1.8.4 Path Traversal / Remote Code Execution
Langflow versions 1.8.4 and below path traversal to remote code execution proof of concept exploit. Exploit Title: Langflow 1.8.4 - Path Traversal to Remote Code Execution Google Dork: N/A Date: 2026-07-20 Exploit Author: cardosource Vendor Homepage: https://www.langflow.org/ Software Link:...
Linux Distros Unpatched Vulnerability : CVE-2026-17548
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Checkmk 2.5.0p12, 2.4.0p36, 2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a background job to view...
Langflow 1.8.4 - Path Traversal to Remote Code Execution
Exploit Title: Langflow 1.8.4 - Path Traversal to Remote Code Execution Google Dork: N/A Date: 2026-07-20 Exploit Author: cardosource Vendor Homepage: https://www.langflow.org/ Software Link: https://github.com/langflow-ai/langflow Version: Dictstr, Any: return "target": target.rstrip'/', "lhost"...
CVE-2026-78038
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ashoban allows a user whose input reaches the :args option of AshOban.buildtrigger/3 to retarget an update or destroy trigger at another record, including across tenants. buildtrigger/3...
CVE-2026-78038 Job argument injection via :args overrides primary_key and tenant in AshOban
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ashoban allows a user whose input reaches the :args option of AshOban.buildtrigger/3 to retarget an update or destroy trigger at another record, including across tenants. buildtrigger/3...
CVE-2026-82473
KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking further upgrade...
PT-2026-83452
Name of the Vulnerable Software and Affected Versions KubeEdge CloudCore versions prior to 1.23.2 Description The HTTPS server in CloudCore accepts node task status reports without authentication verification. An attacker can access CloudCore on port 10002 to manipulate the status of upgrade jobs...
CVE-2026-81299
Subscriber Insecure Direct Object References IDOR in WP Job Portal = 2.5.9 versions...
CVE-2026-81299 WordPress WP Job Portal plugin <= 2.5.9 - Insecure Direct Object References (IDOR) vulnerability
Subscriber Insecure Direct Object References IDOR in WP Job Portal = 2.5.9 versions...
CVE-2026-81299
CVE-2026-81299 affects the WordPress WP Job Portal plugin, versions
EUVD-2026-67729
Subscriber Insecure Direct Object References IDOR in WP Job Portal = 2.5.9 versions...
CVE-2026-81299 WordPress WP Job Portal plugin <= 2.5.9 - Insecure Direct Object References (IDOR) vulnerability
Subscriber Insecure Direct Object References IDOR in WP Job Portal = 2.5.9 versions...