CVE-2026-19085 Copy & Delete Posts < 1.5.6 - Author+ Password-Protected Post Content Disclosure

The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable...

EUVD-2026-63822

The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable...

CVE-2026-19435 Copy & Delete Posts < 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure

The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content...

CVE-2026-77682

A code injection vulnerability exists in Epiphany when the user invokes form autofill from the context menu on a page containing a malicious HTML form. In embed/web-process-extension/resources/js/ephyautofill.js, getSelector builds a CSS selector by directly interpolating an element's id attribut...

bramble v1.18.0-chromium

Bramble A password manager that keeps your secrets on your own devices. No account, no server holding your vault, no company to get breached and leak everything. You hold the vault, you hold the password, and that's it. Bramble runs where you do: Browser extension for Chromium browsers Brave,...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), com.ancientlightstudios:quarkus-kotlin-openapi-test (>=0.0.15, <=0.7.4) +1018 more potentially affected by CVE-2026-19611 via org.wildfly.security:wildfly-elytron-password-impl (>=1.9.0.cr1, <=2.6.10.final)

org.wildfly.security:wildfly-elytron-password-impl MAVEN version =1.9.0.cr1, =0.1.0, =0.0.15, =8.13.0, =8.13.0, =2.3.0, =2.3.0, =2.3.0, =1.2.9, =1.2.9, =1.2.9, =1.4.11 and more Source cves: CVE-2026-19611 Source advisory: SNYK:JAVA-ORGWILDFLYSECURITY-19665498...

Improper Handling of Alternate Encoding

Overview Affected versions of this package are vulnerable to Improper Handling of Alternate Encoding in its password normalization, which applies Unicode NFKC compatibility normalization before hashing and so folds fullwidth and other compatibility characters to their ASCII equivalents. An attack...

EUVD-2026-63730

The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next without checking the caller, and no customer-session middleware guards the route; the on...

CVE-2026-17559: Incorrect Authorization

The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an...

PT-2026-79324

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.15.1.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description Improper encoding or escaping of output in the user interface occurs when using the Instance Reset Password functionality. Th...

CVE-2026-61398: Improper Encoding or Escaping of Output

Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality. This issue affects Apache CloudStack: from 4.15.1.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or...

CVE-2026-27462: Observable Response Discrepancy

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has been fixed in version 3.2.3...

PT-2026-79441

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has been fixed in version 3.2.3...

CVE-2026-53762: Use of Password Hash With Insufficient Computational Effort

VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.29, non-default builds created with WOLFCRYPT=1 and WOLFCRYPTBACKEND route SHA-256 and SHA-512 volume-header key derivation through derivekeysha256 and derivekeysha512 in src/Crypto/wolfCrypt.c, where the...

PT-2026-79370

Name of the Vulnerable Software and Affected Versions Passster WordPress plugin versions prior to 4.3.9 Description The plugin fails to correctly match its public endpoint paths when determining which REST API requests should bypass global password protection. This occurs because the system...

CVE-2026-19085: Authorization Bypass Through User-Controlled Key

The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099440)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099440 advisory. Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. Th...

PT-2026-79307

Name of the Vulnerable Software and Affected Versions Duplicate Post WordPress plugin versions prior to 1.5.6 Description Insufficient validation occurs when duplicating posts, as the plugin fails to verify if the user has permission to read the content before the duplication process. This allows...

CVE-2026-72843

The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next without checking the caller, and no customer-session middleware guards the route; the on...

CVE-2026-55765

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in ALTER ROLE and CREATE ROLE statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and...