15197 matches found
EUVD-2026-57953
Subscriber Privilege Escalation in Service Finder Booking = 6.2 versions...
CVE-2026-28161
Subscriber Privilege Escalation in Service Finder Booking = 6.2 versions...
CVE-2026-28161
CVE-2026-28161 affects the WordPress Service Finder Booking plugin
EUVD-2026-57952
Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...
CVE-2026-28159 WordPress Service Finder Booking plugin <= 6.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...
CVE-2026-28159 WordPress Service Finder Booking plugin <= 6.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...
CVE-2026-28156 WordPress Do Lasso plugin <= 358 - SQL Injection vulnerability
Subscriber SQL Injection in Do Lasso = 358 versions...
CVE-2026-27999
Subscriber Broken Access Control in Tourfic = 2.23.1 versions...
CVE-2026-27535 WordPress Solace Extra plugin <= 1.6.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in Solace Extra = 1.6.0 versions...
CVE-2026-27535
CVE-2026-27535 affects the WordPress Solace Extra plugin up to version 1.6.0. The vulnerability is described as Broken Access Control, enabling lower-privilege attackers to access restricted functionality. The CVSS 3.1 base score is 7.1 (High), with Network attack vector, Low attack complexity, P...
EUVD-2026-57933
Subscriber Broken Access Control in Solace Extra = 1.6.0 versions...
CVE-2026-49827
WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration no invite...
ALPINE-CVE-2026-14666
Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates t...
EUVD-2026-57834
Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates t...
EUVD-2026-57830
WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration no invite...
CVE-2026-49827
WebErpMesv2 (Resource Management and Manufacturing Execution System) versions 1.19 and prior are affected. A vulnerability in the HR Expense scan_file upload allows self-registered users to upload arbitrary PHP files, enabling Remote Code Execution. The issue is exacerbated by open registration (...
CVE-2026-73616 OpenRemote Notification Delete Cross-Realm Insecure Direct Object Reference
OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants...
PT-2026-71530
Subscriber Broken Access Control in Travelfic Toolkit = 1.5.1 versions...