19021 matches found
CVE-2026-15247 Search Atlas SEO < 2.6.24 - Subscriber+ Google Service Account Credential Overwrite/Deletion
The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account...
CVE-2026-15247
The Search Atlas SEO WordPress plugin (versions before 2.6.24 ) contains a vulnerability due to a missing nonce or capability check when processing settings updates in an early-priority handler. This flaw allows any authenticated user , such as one with Subscriber privileges, to overwrite or dele...
CVE-2026-15247 Search Atlas SEO < 2.6.24 - Subscriber+ Google Service Account Credential Overwrite/Deletion
The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account...
SUSE CVE-2026-55495
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUTRELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename, allowing slash and dot-dot segments to escape the source file directory and create or conditionally overwrite...
SUSE CVE-2026-64865
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebarmodules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a...
SUSE CVE-2026-71327
Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute router and...
CVE-2026-15247: Missing Authorization
The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account...
VulnCheck KEV: CVE-2026-67279
Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060...
CVE-2026-67279: Improper Enforcement of Behavioral Workflow
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated...
PT-2026-86319
🚨 CVE-2026-15247 The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google...
CVE-2026-53757
Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip function extracts all ZIP entries via ZipArchive::extractTo without validating entry paths for ../ traversal sequences. Only the first entry's subdirectory structure is checked. An attacker can overwrite...
EUVD-2026-71625
Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip function extracts all ZIP entries via ZipArchive::extractTo without validating entry paths for ../ traversal sequences. Only the first entry's subdirectory structure is checked. An attacker can overwrite...
CVE-2026-82193
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files...
CVE-2026-84066 Directorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_upload
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...
EUVD-2026-70912
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...
CVE-2026-80438: Improper Access Control
The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress...
CVE-2026-84066: Missing Authorization
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...
CVE-2026-82193: Improper Limitation of a Pathname to a Restricted Directory
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files...
PT-2026-85423
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...
CVE-2026-53757: Improper Limitation of a Pathname to a Restricted Directory
Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip function extracts all ZIP entries via ZipArchive::extractTo without validating entry paths for ../ traversal sequences. Only the first entry's subdirectory structure is checked. An attacker can overwrite...