2352 matches found
CVE-2026-15550 Ninja Forms - Save Progress <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook
The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulkactions' function. This makes it possible for authenticated attackers, with...
WordPress Ninja Forms - Save Progress plugin <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook vulnerability
WordPress Ninja Forms - Save Progress plugin = 3.0.30 - Missing Authorization to Authenticated Subscriber+ Arbitrary Data Deletion via admin-ajax.php with admininit Hook vulnerability discovered by Hermione in WordPress Plugin Ninja Forms - Save Progress versions = 3.0.30...
PT-2026-86408
The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulk actions' function. This makes it possible for authenticated attackers, with...
CVE-2026-15550: Missing Authorization
The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulkactions' function. This makes it possible for authenticated attackers, with...
CVE-2026-19219
creationtimestamp| type| source ---|---|--- 2026-09-02 16:15:11+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/progress-software-security-advisory-av26-875 2026-09-02 16:37:46+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mukenume3j25...
CVE-2026-18672
creationtimestamp| type| source ---|---|--- 2026-09-02 16:15:09+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/progress-software-security-advisory-av26-875 2026-09-02 16:37:03+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mukemlw3f72q...
CVE-2026-81195
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data, allowing unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user...
CVE-2026-19219: Insufficient Verification of Data Authenticity
In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to alter the folders the file browser reads from, writes to,...
CVE-2026-18672: Improper Limitation of a Pathname to a Restricted Directory
In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories...
CVE-2026-81195: Exposure of Sensitive Information to an Unauthorized Actor
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data, allowing unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user...
SUSE CVE-2026-72293
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: Add missing radixtreepreload in gaccessshadowfault Add missing radixtreepreload in gaccessshadowfault to guarantee forward progress. The core of gaccessshadowfault has been split into gaccessshadowfault in order ...
glibc: Non-progress DoS in SHIFT_JISX0213 ->
A flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFTJISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to...
[SECURITY] Fedora 43 Update: rust-anstyle-progress-0.1.4-1.fc43
ANSI escape code progress reporting OSC 9;4...
[SECURITY] Fedora 44 Update: rust-anstyle-progress-0.1.4-1.fc44
ANSI escape code progress reporting OSC 9;4...
Linux Distros Unpatched Vulnerability : CVE-2026-77117
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Converting crafted SHIFTJISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may...
Linux Distros Unpatched Vulnerability : CVE-2026-80489
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Converting crafted EUCJISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may resu...
Fedora 43 : rust-anstyle-hyperlink / rust-anstyle-progress / rust-cargo / etc (2026-ce685f40fe)
The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-ce685f40fe advisory. - Update cargo-c to version 0.10.24 plus dependency updates. - Initial packaging of the anstyle-hyperlink, anstyle-progress, and cargo-util-terminal crates...
WordPress Masteriyo LMS plugin < 2.2.1 - Unauthenticated Course Progress Disclosure and Deletion vulnerability
Unauthenticated Course Progress Disclosure and Deletion vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Masteriyo - LMS versions 2.2.1...
CVE-2026-78322: Buffer Copy without Checking Size of Input
A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer...
CVE-2026-79775: Improper Validation of Array Index
rclone versions = v1.72.0 and = v1.74.4 fixed in v1.75.0 contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which relies on the github.com/diskfs/go-diskfs dependency. The parser fails to validate attacker-controlled superblock and metadata values before...