4637 matches found
CVE-2026-104803: Improper Authentication
The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the uuid and code parameters of the social-login callback handler registered on the init hook. The vulnerability exists because the login function's social-login flow...
GHSA-39P5-2WRR-XH29 Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project
Summary When you share a project with a team, the API lets you attach any team on the instance, including teams you have nothing to do with, as long as you're an admin of the project. Listing a project's teams then returns each team's full member roster. So any logged-in user can spin up a...
WordPress WPCOM Member plugin <= 1.7.27 - Unauthenticated Authentication Bypass vulnerability
Unauthenticated Authentication Bypass vulnerability discovered by Mohamed Khater in WordPress Plugin WPCOM Member versions = 1.7.27...
CVE-2026-65591
CVE-2026-65591 Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.64 n8n versions prior to 2.29.8 n8n versions prior to 2.30.1 Description A sanitizer bypass exists in the legacy expression evaluator's computed-member handler. An authenticated user with permissions ...
WordPress Advanced Form Integration plugin <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action vulnerability
Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action vulnerability discovered by wachiss - Datafarm Co., Ltd. in WordPress Plugin Advanced Form Integration versions = 2.9.0...
BIT-GHOST-2026-103284 Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback
Ghost versions from 5.125.1 before 6.57.1 contain an information disclosure vulnerability in the Admin Feedback endpoint that allows unauthorized staff users to access member data. Attackers with staff privileges can query the feedback endpoint to retrieve sensitive member information without...
CVE-2026-96539
Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1...
CVE-2026-96539 WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1...
EUVD-2026-95590
Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1...
CVE-2026-96539
The Ultimate Member WordPress plugin (versions
PT-2026-108860
Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1...
CVE-2026-96539: Incorrect Privilege Assignment
Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1...
CVE-2026-107726
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, an...
CVE-2026-107726 Hazelcast: Arbitrary member memory access by low-privileged client
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, an...
EUVD-2026-95314
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, an...
EUVD-2026-43180
PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass...
PT-2026-107995
pH7Builder pH7 Social Dating CMS before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain any membership tier by supplying client-controlled plan and amount fields. Attackers can set item number, cart order id, or the PayPal custom field...
PT-2026-108115
Name of the Vulnerable Software and Affected Versions OpenStack Mistral versions prior to 23.0.0 Description The std.ssh proxied action passes a caller-supplied proxy command value directly to the paramiko.ProxyCommand function before attempting an SSH connection to a gateway or target host. An...
CVE-2026-107726: Improper Input Validation
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, an...
