512 matches found
CVE-2026-123292
In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid...
CVE-2026-123292
In JetBrains Datalore versions prior to 2026.4 , a vulnerability exists where API tokens and sessions belonging to removed or banned users remain valid. This issue is categorized under CWE-1464: Improper Session Invalidation . The impact allows potentially unauthorized continued access through pe...
EUVD-2026-118057
In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid...
CVE-2026-123292
In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid...
Windmill < 1.603.3 - SQL Injection
Windmill versions 1.276.0 through 1.603.2 contain an authenticated SQL injection vulnerability in the folder owner management endpoint. The addowner API endpoint passes user-supplied input directly into a SQL query without sanitization, enabling JSONB path injection. An authenticated user with...
CVE-2026-123292: JetBrains Datalore: In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid
In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid...
EvilSlackbot
EvilSlackbot A Slack Attack Framework for conducting Red Team and phishing exercises within Slack workspaces. Disclaimer This tool is intended for Security Professionals only. Do not use this tool against any Slack workspace without explicit permission to test. Use at your own risk. Background...
github-endpoints
github-endpoints Find endpoints on GitHub. Description This Go tool performs searches on GitHub and parses the results to find endpoints of a given domain. Install go install github.com/gwen001/github-endpoints@latest or git clone https://github.com/gwen001/github-endpoints cd github-endpoints go...
CVE-2023-6289
CVE-2023-6289 Swift Performance Lite = 2.3.6.14 - Missing Authorization to Unauthenticated Settings Export Description The Swift Performance Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the on functionality hooked via admininit functi...
CVE-2026-63378
TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a valid fctrsession cookie can submit arbitrary Python source in the scriptcode field of POST /api/react/execute-script, witho...
CVE-2026-112905
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, authenticated IDOR on admin/auth-token endpoint allows any administrator to read and overwrite another administrator's API tokens. This issue has been patched in versi...
EUVD-2026-114083
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, authenticated IDOR on admin/auth-token endpoint allows any administrator to read and overwrite another administrator's API tokens. This issue has been patched in versi...
CVE-2026-112905: givanz Vvveb: Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, authenticated IDOR on admin/auth-token endpoint allows any administrator to read and overwrite another administrator's API tokens. This issue has been patched in versi...
PT-2026-133572
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, authenticated IDOR on admin/auth-token endpoint allows any administrator to read and overwrite another administrator's API tokens. This issue has been patched in versi...
PT-2026-134242
Name of the Vulnerable Software and Affected Versions TAKO AI Agent for Okta versions prior to 3.0.1-beta Description Authenticated users with a valid fctr session cookie can execute arbitrary Python code without administrator privileges. By sending a request to the 'POST /api/react/execute-scrip...
CVE-2026-91153
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary...
EUVD-2026-112691
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary...
PT-2026-130690
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary...
WordPress Everest Forms information disclosure vulnerability
WordPress Everest Forms versions 3.6.2 and earlier contain an information disclosure vulnerability. This vulnerability arises from the exposure of sensitive information; unauthenticated attackers can submit nonces via public rendering or anonymous generation. By utilizing form notifications email...
CVE-2026-91153: wpeverest: The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is…
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary...