SUSE CVE-2026-55496

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predicate and serializes matches at RedactLevelUser, allowing any logged-in user to enumerate email addresses and profile metadata for inactive ...

PT-2026-86319

🚨 CVE-2026-15247 The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google...

CVE-2026-15247: Missing Authorization

The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account...

CVE-2026-85589 phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...

EUVD-2026-71012

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...

CVE-2026-85589 phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...

CVE-2026-85589

phpMyFAQ before 4.2.0-alpha.2 is affected by a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health. These endpoints enforce only authentication but omit permission checks, allowing any authenticated user—regardless of privilege level—to read site-w...

CVE-2026-85589 phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...

ICE Wants to Know Everyone Who Bought a Certain Green Beanie From REI in the Last 2 Years

Homeland Security Investigations agents hit the outdoor retailer with a controversial subpoena as part of a dragnet search for the identities of protesters who entered a Minnesota church in March...

CVE-2026-81270

Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...

CVE-2026-81270 Apache Allura: Information exposure via search

Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...

EUVD-2026-70924

Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...

CVE-2026-81270

Apache Allura versions through 1.20.0 are vulnerable to the exposure of non-public information via the search functionality. This vulnerability allows an unauthorized actor to access sensitive information. To remediate this issue, users are recommended to upgrade to version 1.21.0 .

CVE-2026-81270 Apache Allura: Information exposure via search

Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...

CVE-2026-85397

A vulnerability was determined in code-projects Hospital Information System 1.0. This impacts the function findBySearch of the file addReq.php. This manipulation of the argument Search causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed an...

EUVD-2026-70859

A vulnerability was determined in code-projects Hospital Information System 1.0. This impacts the function findBySearch of the file addReq.php. This manipulation of the argument Search causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed an...

CVE-2026-85397

A SQL injection vulnerability exists in code-projects Hospital Information System 1.0 , specifically in the findBySearch function within addReq.php . An unauthenticated remote attacker can manipulate the Search argument to inject arbitrary SQL, leading to low-impact compromise of confidentiality,...

CVE-2026-11817

In multi-organization deployments, an Org Admin in one organization could call GET /api/access-control/users/permissions/search with actionPrefix=dashboards: and obtain dashboard and folder UIDs plus per-user permission mappings from other organizations. Single-organization deployments are not...

CVE-2026-85589: Missing Authorization

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...

PT-2026-85430

Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...