300072 matches found
PT-2026-84765
Name of the Vulnerable Software and Affected Versions Linux Kernel versions 6.15 and later Description An issue exists where the X-mount.subdir option utilizes a detached-tree fast path and passes the configured subdirectory to the open tree function using the AT SYMLINK NOFOLLOW flag. This flag...
CVE-2026-81198: Authorization Bypass Through User-Controlled Key
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other...
CVE-2026-12526: Improper Authentication
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...
CVE-2026-80467: Improper Privilege Management
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with...
CVE-2026-49249: Uncontrolled Resource Consumption
Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, BorutaIdentityWeb.UserSettingsController.update/2 atomizes every key of the user-supplied request body via String.toatom/1 before a...
CVE-2026-79989: Improper Authorization
The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission which doesn’t allow changing...
PT-2026-84672
Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revisionCreator fields. Attackers with a scoped GraphQL token can query these relations to read usernames, email addresses, and full names of a...
CVE-2026-84795: Improper Privilege Management
Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification...
PT-2026-84683
Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...
PT-2026-84728
The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users...
PT-2026-84709
A vulnerability exists in the affected products that allows a threat actor to gain access to user’s projects. To exploit this vulnerability the threat actor must have basic user privileges. If exploited, the threat actor can modify and delete the project...
Fedora 44 : emacs (2026-e47f5a0b84)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e47f5a0b84 advisory. Fix CVE-2026-79992: Local shell command injection through the user field in emacs tramp Tenable has extracted the preceding description block directly from t...
SplitView Component Compromise DoS
The vulnerability of the SplitView component in Google Chrome and Microsoft Edge relates to the improper presentation of critical information to the user interface. Exploiting this vulnerability can allow an attacker to compromise data integrity and also cause service interruptions through the us...
Autofill Component Data Compromise
The vulnerability of the Autofill component in Google Chrome and Microsoft Edge relates to the user interface’s false representation of critical information. Exploiting this vulnerability can allow a malicious actor to compromise data integrity and also cause service interruptions through the use...
PageInfo Component Compromise Data Compromise
The vulnerability of the PageInfo component in Google Chrome and Microsoft Edge relates to the improper presentation of critical information to the user interface. Exploiting this vulnerability can allow an attacker to compromise data integrity through a specially created HTML page...
CSS components compromise Data Compromise
The vulnerability of the CSS component in Google Chrome and Microsoft Edge relates to the improper presentation of critical information to the user interface. Exploiting this vulnerability can allow an attacker to compromise data integrity through a specially created HTML page...
Extensions Component Data Compromise
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge relates to the false representation of critical information to the user interface. Exploiting this vulnerability can allow an attacker to compromise data integrity remotely...
Fedora 44 : gdk-pixbuf2 (2026-001de57d4f)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-001de57d4f advisory. Fixes https://access.redhat.com/security/cve/CVE-2026-81893 Tenable has extracted the preceding description block directly from the Fedora security advisory...
CVE-2026-81283: Deserialization of Untrusted Data
Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...
CVE-2026-19453: Improper Privilege Management
The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates th...