audit_couchdb

Audit CouchDB: The simple, clear, CouchDB security assessment Audit CouchDB is a simple tool with a powerful message. Given an Apache CouchDB URL, it will tell you everything you ever wanted to know about its security. Objective Audit CouchDB will perform the following actions: 1. Learn every...

LearnPress < 4.3.7 - Information Disclosure

LearnPress WordPress plugin 4.3.7 contains an information disclosure vulnerability caused by missing capability checks on a REST endpoint, letting unauthenticated visitors retrieve sensitive user role and capability data via crafted requests. id: CVE-2026-8383 info: name: LearnPress 4.3.7 -...

Blinko <= 1.8.3 - User Information Leak

Blinko = 1.8.4 contains an information disclosure caused by a publicly accessible endpoint exposing user information including usernames, roles, and account creation dates, letting remote attackers access sensitive user data, exploit requires no special privileges. id: CVE-2026-23486 info: name:...

linux

Linux kernel The Linux kernel is the core of any Linux operating system. It manages hardware, system resources, and provides the fundamental services for all other software. Quick Start Report a bug: See Documentation/admin-guide/reporting-issues.rst Get the latest kernel: https://kernel.org Buil...

CVE-2026-118567

Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5...

CVE-2026-118567

The Bulk Update User Roles Drupal module (versions 0.0.0 to 1.0.5 ) contains an incorrect authorization vulnerability (CWE-863) that allows Forceful Browsing . The root cause is that the bulk update form fails to prevent access to users who lack the necessary permissions to assign roles. While th...

EUVD-2026-113691

Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5...

CVE-2026-104767

The Membership & User Roles for WooCommerce Automatic Role Changer plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. This is due to the maybeaddroletouser function unconditionally re-assigning every role stored in the dfxwcrcforeignroles user...

CVE-2026-104767 Membership & User Roles for WooCommerce (Automatic Role Changer) <= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache

The Membership & User Roles for WooCommerce Automatic Role Changer plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. This is due to the maybeaddroletouser function unconditionally re-assigning every role stored in the dfxwcrcforeignroles user...

EUVD-2026-100767

The Membership & User Roles for WooCommerce Automatic Role Changer plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. This is due to the maybeaddroletouser function unconditionally re-assigning every role stored in the dfxwcrcforeignroles user...

CVE-2026-104767 Membership & User Roles for WooCommerce (Automatic Role Changer) <= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache

The Membership & User Roles for WooCommerce Automatic Role Changer plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. This is due to the maybeaddroletouser function unconditionally re-assigning every role stored in the dfxwcrcforeignroles user...

CVE-2026-104767

The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 20260828 . The root cause is that the maybe_add_role_to_user() function unconditionally re-assigns roles from the dfxwcrc_foreign_roles u...

PT-2026-113592

The Membership & User Roles for WooCommerce Automatic Role Changer plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. This is due to the maybe add role to user function unconditionally re-assigning every role stored in the dfxwcrc foreign roles...

CVE-2026-104767: Improper Privilege Management

The Membership & User Roles for WooCommerce Automatic Role Changer plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828. This is due to the maybeaddroletouser function unconditionally re-assigning every role stored in the dfxwcrcforeignroles user...

WordPress Membership & User Roles for WooCommerce (Automatic Role Changer) plugin <= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache vulnerability

Authenticated Subscriber+ Privilege Escalation to Stale Foreign Role Cache vulnerability discovered by Azgnt in WordPress Plugin DFX Automatic Role Changer for WooCommerce versions = 20260828...

Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation

Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit users documents with duplicate keysfor 'roles' used for access control within the database, including the special case 'admin' role, th...

PT-2026-67112

The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing...

EUVD-2026-44950

Axelor Open Platform versions 8.x prior to 8.2.2 contains an authorization bypass vulnerability that allows authenticated non-admin users to escalate privileges by exploiting unenforced field restrictions on nested relational save operations. Attackers can modify sensitive User record fields such...

CVE-2026-63085

Axelor Open Platform 8.x prior to 8.2.2 contains an authorization bypass vulnerability. Authenticated non-admins can escalate privileges by exploiting unenforced field restrictions on nested relational save operations, enabling modification of sensitive User fields (roles, groups) through a relat...

CVE-2026-63085 Axelor Open Platform 8.x < 8.2.2 Authorization Bypass via Nested Relational Record Persistence

Axelor Open Platform versions 8.x prior to 8.2.2 contains an authorization bypass vulnerability that allows authenticated non-admin users to escalate privileges by exploiting unenforced field restrictions on nested relational save operations. Attackers can modify sensitive User record fields such...