Lucene search
+L

13670 matches found

EUVD
EUVD
•added 2026/09/13 10:45 a.m.•12 views

EUVD-2026-76989

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete...

8.6CVSS5.8AI score0.00426EPSS
SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/13 10:45 a.m.•35 views

CVE-2026-90768 CAPEv2 through commit 471ee4b REST API Task Endpoints Missing Ownership Check

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete...

8.6CVSS0.00426EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
•added 2026/09/13 10:45 a.m.•9 views

CVE-2026-90768 CAPEv2 through commit 471ee4b REST API Task Endpoints Missing Ownership Check

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete...

8.6CVSS5.8AI score0.00426EPSS
SaveExploits0References4
CVE
CVE
•added 2026/09/13 10:45 a.m.•22 views

CVE-2026-90768

CAPEv2 (malware analysis platform) through commit 471ee4b fails to validate task ownership in its REST API task view and delete endpoints . An authenticated user can enumerate all tasks in the system and read or delete analyses submitted by other users, without any ownership verification. The CVS...

8.6CVSS5.8AI score0.00426EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/09/13 12:00 a.m.•17 views

PT-2026-90961

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every...

8.8CVSS5.9AI score0.00502EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
•added 2026/09/13 12:00 a.m.•18 views

PT-2026-90985

A vulnerability was found in getzep graphiti up to 0.30.2. Affected is an unknown function of the file server/graph service/main.py of the component REST API. The manipulation results in improper authentication. The attack can be launched remotely. The pull request to fix this issue awaits...

7.5CVSS6.8AI score0.00693EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
•added 2026/09/13 12:00 a.m.•13 views

PT-2026-90835

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete...

8.6CVSS5.8AI score0.00426EPSS
SaveExploits0References5
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/13 12:00 a.m.•2 views

CVE-2026-74933: Missing Authorization

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every...

8.8CVSS6AI score0.00502EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/13 12:00 a.m.•2 views

CVE-2026-90768: Missing Authorization

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete...

8.6CVSS5.9AI score0.00426EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/13 12:00 a.m.•1 views

CVE-2026-90601: Improper Authentication

A vulnerability was found in getzep graphiti up to 0.30.2. Affected is an unknown function of the file server/graphservice/main.py of the component REST API. The manipulation results in improper authentication. The attack can be launched remotely. The pull request to fix this issue awaits...

7.5CVSS6.7AI score0.00693EPSS
SaveExploits0References2
NVD
NVD
•added 2026/09/12 6:16 a.m.•13 views

CVE-2026-87888

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...

8CVSS0.00413EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/12 6:16 a.m.•14 views

CVE-2026-77753

The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site ov...

5.5CVSS0.00321EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/12 6:16 a.m.•15 views

CVE-2026-81742

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...

8.8CVSS0.00505EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
•added 2026/09/12 6:00 a.m.•10 views

CVE-2026-87888 YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...

5.7AI score0.00413EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
•added 2026/09/12 6:00 a.m.•12 views

CVE-2026-87891 Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...

5.6AI score0.00343EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/12 6:00 a.m.•13 views

EUVD-2026-76801

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...

8CVSS5.7AI score0.00413EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/12 6:00 a.m.•40 views

CVE-2026-87888 YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...

0.00413EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/12 6:00 a.m.•44 views

CVE-2026-87891 Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...

0.00343EPSS
SaveExploits0References1
CVE
CVE
•added 2026/09/12 6:00 a.m.•14 views

CVE-2026-87891

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...

6.5CVSS5.6AI score0.00343EPSS
SaveExploits0References1
CVE
CVE
•added 2026/09/12 6:00 a.m.•13 views

CVE-2026-87888

The YayPricing WordPress plugin (versions before 3.5.7 ) is vulnerable to a Stored XSS flaw due to a missing authorization check on a REST route used to save pricing rules. This allows users with the subscriber role and above to inject and store malicious JavaScript. If an administrator views the...

8CVSS5.7AI score0.00413EPSS
SaveExploits0References1
Rows per page
Query Builder