388 matches found
WordPress Accordions - Unauthenticated Settings Update
Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin = 2.0.2 at WordPress. id: CVE-2022-33198 info: name: WordPress Accordions - Unauthenticated Settings Update author: riteshs4hu severity: critical description: | Unauthenticated WordPress Options Change...
CVE-2026-2520 Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, wit...
CVE-2026-2520
The Bookly WordPress plugin (Online Scheduling and Appointment Booking System) is affected by a missing capability check on the updateAddon function in all versions up to and including 27.2 . Authenticated attackers with Subscriber-level access or higher can trigger an update of any plugin whose ...
CVE-2026-2520 Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, wit...
WordPress Online Scheduling and Appointment Booking System – Bookly plugin <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update vulnerability
Missing Authorization to Authenticated Subscriber+ Limited Arbitrary Plugin Update vulnerability discovered by KoreaInfoSec in WordPress Plugin Bookly versions = 27.2...
Important: Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update
Updated images are now available for Red Hat Ansible Automation Platform 2.1, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub. Red Hat Ansible Automation Platform 2.1 delivers an Ansible-first Red Hat Developer...
CVE-2026-16074
A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function updateplugin/updateallplugins of the file astrbot/dashboard/routes/plugin.py of the component Plugin Update Handler. The manipulation of the argument downloadurl/downloadurls/proxy results in server-side...
CVE-2026-16074 AstrBotDevs AstrBot Plugin Update plugin.py update_all_plugins server-side request forgery
A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function updateplugin/updateallplugins of the file astrbot/dashboard/routes/plugin.py of the component Plugin Update Handler. The manipulation of the argument downloadurl/downloadurls/proxy results in server-side...
CVE-2026-16074
A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function updateplugin/updateallplugins of the file astrbot/dashboard/routes/plugin.py of the component Plugin Update Handler. The manipulation of the argument downloadurl/downloadurls/proxy results in server-side...
PT-2026-60877
A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function update plugin/update all plugins of the file astrbot/dashboard/routes/plugin.py of the component Plugin Update Handler. The manipulation of the argument download url/download urls/proxy results in...
CVE-2026-16074: Server-Side Request Forgery (SSRF)
A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function updateplugin/updateallplugins of the file astrbot/dashboard/routes/plugin.py of the component Plugin Update Handler. The manipulation of the argument downloadurl/downloadurls/proxy results in server-side...
Security Bulletin: IBM Security QRadar Log Management AQL Plugin is vulnerable to using components with known vulnerabilities
Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. IBM Security QRadar Log Management AQL Plugin has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-34077 DESCRIPTION: React...
Exploit for CVE-2026-0740
CVE-2026-0740 — Mass-Target Exploit Engine Author: 0xNuts...
Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests
Summary The modules/plugins.php endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF token validation. Because these are top-level navigations, browsers include SameSite=Lax session cookies. An attacker crafts a malicious page that, when an...
Cross-site Request Forgery (CSRF)
Overview admidio/admidio is a free open source user management system for websites of organizations and groups. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the modules/plugins.php process. An attacker can trigger unauthorized plugin installation,...
GHSA-HM42-Q32M-VJ4F Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests
Summary The modules/plugins.php endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF token validation. Because these are top-level navigations, browsers include SameSite=Lax session cookies. An attacker crafts a malicious page that, when an...
Fedora 43 : python-streamlink (2026-4d6aae2d33)
The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4d6aae2d33 advisory. streamlink 8.4.0 2026-05-06 - SECURITY: fixed arbitrary local file read via file:// URI in HLS and DASH CVE-2026-44353 / GHSA- hgqw-6m45-hw5f - Added:...
Authorization Bypass Through User-Controlled Key
Overview @lobehub/lobehub is a LobeHub - an open-source,comprehensive AI Agent framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Supports one-click free deployment of your private ChatGPT/LLM web application. Affected versions of this package are...
CVE-2026-40926
WWBN AVideo is an open source video platform. In versions 29.0 and prior, three admin-only JSON endpoints — objects/categoryAddNew.json.php, objects/categoryDelete.json.php, and objects/pluginRunUpdateScript.json.php — enforce only a role check Category::canCreateCategory / User::isAdmin and...