44323 matches found
CVE-2026-16057
The Contest Gallery WordPress plugin (versions prior to 30.0.7 ) is vulnerable to arbitrary post deletion due to the post_cg_youtube_delete_from_library handler. The plugin fails to perform per-object capability or nonce checks , relying instead on a coarse role-membership test. This allows any u...
CVE-2026-16057
The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other...
CVE-2026-16057 Contest Gallery < 30.0.7 - Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_library
The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other...
CVE-2026-16057 Contest Gallery < 30.0.7 - Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_library
The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other...
EUVD-2026-52162
The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only by a coarse role-membership test, which allows any Author-level or higher user to permanently delete arbitrary posts, pages, and other...
Exploit for CVE-2026-3030
--- CVE-2026-3030 – Prototype Pollution in JSON Merge Patch...
[SECURITY] Fedora 44 Update: goaccess-1.11-1.fc44
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems. It provides fast and valuable HTTP statistics for system administrators that require a visual server report on the fly. Features: GoAccess parses the specified web log file and outputs the data...
Exploit for Improper Privilege Management in Google Chrome
--- 3. CVE-2026-9999 – Serverless Function Event Injection...
PT-2026-67416
Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the save temporary mode of mylist function.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users'...
PT-2026-67398
Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...
CVE-2026-18642: Deserialization of Untrusted Data
Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...
PT-2026-67090
Name of the Vulnerable Software and Affected Versions The Contest Gallery WordPress plugin versions prior to 30.0.7 Description Insufficient per-object capability and nonce checks in a post-deletion handler allow users with Author-level permissions or higher to permanently delete arbitrary posts,...
axios Prototype Modification
The vulnerability of the axios library is related to uncontrolled changes in the attributes of the object’s prototype. Exploiting this vulnerability can allow a malicious actor to compromise the integrity of the protected information...
PT-2026-67109
The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code execution when a suitable gadget chain is present in the...
CVE-2026-16297: Deserialization of Untrusted Data
The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code execution when a suitable gadget chain is present in the...
CVE-2025-71400
better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with...
CVE-2025-71400 better-auth passkey before 1.4.0 IDOR via delete-passkey
better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with...
CVE-2025-71400
better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with...
CVE-2025-71400 better-auth passkey before 1.4.0 IDOR via delete-passkey
better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with...