Apache Superset <=1.3.2 - Default Login

Apache Superset through 1.3.2 contains a default login vulnerability via registered database connections for authenticated users. An attacker can obtain access to user accounts and thereby obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2021-44451 info:...

CVE-2025-12030

CVE-2025-12030: Insecure Direct Object Reference in ACF to REST API WordPress Plugin Keywords: CVE-2025-12030, ACF to REST API vulnerability, IDOR, WordPress security, authenticated exploit, WordPress plugin vulnerability, CWE-639, ACF field modification, authorization bypass, WordPress CVE 2025,...

CVE-2026-17538

The LatePoint - Appointment Booking & Reservation plugin for WordPress (versions

CVE-2026-76280

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, an authenticated user who does not hold the "admin" or "scadmin" Splunk roles could modify Splunk Secure Gateway alert and mobile-device recipient data in...

CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

EUVD-2026-94632

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, an authenticated user who does not hold the "admin" or "scadmin" Splunk roles could modify Splunk Secure Gateway alert and mobile-device recipient data in...

CVE-2026-107363

In OpenStack Zaqar before version 23.0.1 , a vulnerability exists in the WebSocket transport where it fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token . An authenticated user with a valid token for one project can substitute another pr...

CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

CVE-2026-107363

In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, o...

CVE-2026-86684

A flaw was found in Gitea. An improper authorization check in the push mirror API allows an authenticated repository administrator to bypass local file system access restrictions. When a repository owner has permission to use local paths, an administrator lacking that privilege can configure a pu...

CVE-2026-84654

A flaw was found in Stapler, a web framework used by Jenkins. This vulnerability allows an attacker, who can submit configuration forms, to modify public static fields of configuration objects. This modification can lead to changes that apply globally across the entire Jenkins instance, potential...

CVE-2026-107174

A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability by embedding links pointing outside the extraction...

CVE-2022-1421

CVE-2022-1421 Una Prueba de Concepto para CVE-2022-1421 Discy Referencias https://wpscan.com/vulnerability/a7a24e8e-9056-4967-bcad-b96cc0c5b249 https://vulners.com/cve/CVE-2022-1421...

CVE-2026-107174

A security boundary bypass vulnerability exists in source-to-image due to improper sanitization of symbolic links during archive unpacking. An attacker providing a malicious builder image can embed absolute symbolic links pointing outside the extraction directory. This flaw allows the attacker to...

EUVD-2026-94367

A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability by embedding links pointing outside the extraction...

CVE-2026-107174 Source-to-image: source-to-image: security boundary bypass via absolute symbolic link extraction

A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability by embedding links pointing outside the extraction...

CVE-2026-107174

A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability by embedding links pointing outside the extraction...

CVE-2026-103435

A flaw was found in claude-code. An attacker with write access to a shared workspace can achieve arbitrary file modification and privilege escalation by exploiting a time-of-check to time-of-use TOCTOU race condition. By replacing a project file with a symbolic link between the permission check a...

CVE-2026-106486

A flaw was found in the Backstage Bitbucket Scaffolder backend modules. The Bitbucket pull request Scaffolder actions do not properly validate filesystem paths. An authenticated attacker who can execute an eligible template and influence an allowed repository can manipulate files outside the...