47403 matches found
CVE-2026-71959: Missing Authorization
Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to write forged, arbitrarily backdated entries into any organization's audit log...
CVE-2026-72589: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database...
CVE-2026-17018: Authorization Bypass Through User-Controlled Key
The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...
CVE-2026-72690: Authorization Bypass Through User-Controlled Key
An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/eventid/question/create endpoint. The postCreateEventQuestion method loads the...
CVE-2026-72588: Observable Response Discrepancy
A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code...
CVE-2026-59233: Authorization Bypass Through User-Controlled Key
Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no...
CVE-2026-71962: Missing Authorization
Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypass...
PT-2026-69677
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Out-of-bounds reads occur in three sideband reply parsers when reading 16-bit fields. The issue arises because bounds are checked only after the read operation. Specifically, when the...
CVE-2026-19077: Authorization Bypass Through User-Controlled Key
The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site...
PT-2026-69482
Name of the Vulnerable Software and Affected Versions Roskus Prospero Flow CRM versions prior to 5.2.1 Description The permission management component contains a flaw where the permission save endpoint does not perform authorization checks. This allows any authenticated user to grant any role,...
CVE-2026-19369
creationtimestamp| type| source ---|---|--- 2026-08-09 22:42:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/dzrqtrm37fwwb...
CVE-2026-67622
creationtimestamp| type| source ---|---|--- 2026-08-09 16:00:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msnxegt2qg2h 2026-08-10 17:18:10+00:00| seen| https://gist.github.com/haidang-infosec/402db84bee7aca2f57bb109b31574649...
CVE-2026-67621
creationtimestamp| type| source ---|---|--- 2026-08-09 16:00:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msnxea4z4f2u...
CVE-2026-15153
creationtimestamp| type| source ---|---|--- 2026-08-09 14:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msnrkhs5la26...
CVE-2026-70628
creationtimestamp| type| source ---|---|--- 2026-08-09 14:02:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msnqoqqo7y27...
CVE-2026-71947
creationtimestamp| type| source ---|---|--- 2026-08-09 14:02:02+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117065912163705973...
CVE-2026-19351
creationtimestamp| type| source ---|---|--- 2026-08-09 12:52:41+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3msnmvbvrda2j 2026-08-10 11:39:42+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mspzbq3juj2w...
CVE-2026-19281
creationtimestamp| type| source ---|---|--- 2026-08-09 11:39:39+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3msnisozdov2l...