47279 matches found
CVE-2026-13404
The Royal Addons for Elementor WordPress plugin (versions before 1.7.1066 ) is vulnerable to an authorization bypass. The software fails to perform proper capability or ownership checks when writing like-count and visitor-tracking post meta, relying instead on a publicly-scrapeable nonce . This f...
EUVD-2026-66266
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check relying only on a publicly-scrapeable nonce before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that...
CVE-2026-79282
creationtimestamp| type| source ---|---|--- 2026-08-26 04:10:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtxhmgfdze2t 2026-08-26 05:19:36+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260826 2026-08-26 11:17:43+00:00| seen|...
CVE-2026-66152
creationtimestamp| type| source ---|---|--- 2026-08-26 01:42:39+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mtx7et2zyz2q 2026-08-26 12:30:20+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtydkyf5re2o 2026-09-24 22:45:52+00:00| seen|...
CVE-2026-63074
creationtimestamp| type| source ---|---|--- 2026-08-26 01:09:35+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3mtx5jnfojs24 2026-08-26 12:35:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtydtvyhrf2r 2026-08-27 04:07:29+00:00| seen|...
CVE-2026-65637
creationtimestamp| type| source ---|---|--- 2026-08-26 00:54:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/4q2jod4or3iqp 2026-08-26 12:30:27+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtydl6w76z2k 2026-08-27 16:00:08+00:00| seen|...
CVE-2026-65183
creationtimestamp| type| source ---|---|--- 2026-08-26 00:48:12+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/75todjuu5eek7 2026-08-26 12:30:27+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtydl6w76z2k...
EUVD-2026-66132
Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from...
CVE-2026-80138
creationtimestamp| type| source ---|---|--- 2026-08-26 00:01:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtwzq5epzv2u 2026-08-26 00:08:04+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtx23pmcxz25 2026-08-26 01:50:06+00:00| seen|...
CVE-2026-48549: Cross-Site Request Forgery (CSRF)
Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie protection can be bypassed by supplying matching NagFormId and nagFormId values in the POST body, allowing a cross-site request to execute...
CVE-2026-48786: Exposure of Sensitive Information to an Unauthorized Actor
Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint POST /api/latest/fleet/targets returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-clas...
PT-2026-81943
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check relying only on a publicly-scrapeable nonce before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that...
PT-2026-82217
Name of the Vulnerable Software and Affected Versions OpenMetadata versions prior to 2.0.0 Description The software accepts a caller-supplied post-authentication redirect target and appends the issued token to it. The SamlLoginServlet reads the callback request parameter and stores it in the HTTP...
CVE-2026-13404: Authorization Bypass Through User-Controlled Key
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check relying only on a publicly-scrapeable nonce before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that...
CVE-2026-80200 Kimai before 2.53.0 Open Redirect via RelayState
Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as redirect destinations. Attackers with IdP access can supply malicious RelayState values to redirect authenticated users to...
CVE-2026-80186
creationtimestamp| type| source ---|---|--- 2026-08-25 22:59:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtwwbvvglr27...
CVE-2026-79787
creationtimestamp| type| source ---|---|--- 2026-08-25 20:08:24+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtwmp5yebg2p 2026-08-26 01:00:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtx4yr622p23...
CVE-2026-78379
creationtimestamp| type| source ---|---|--- 2026-08-25 20:08:16+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtwmovwkty2m 2026-08-26 01:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtx5kkus2g2p 2026-08-26 14:47:54+00:00| seen|...