169041 matches found
CVE-2026-81793
An unauthenticated Broken Access Control vulnerability affects the WordPress Salon booking system plugin in versions 10.31.5 and earlier . Discovered by Tiago Ventura (@perses), the flaw allows attackers to access or modify data with low integrity and low availability impact without requiring any...
CVE-2026-81788 WordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in IMPress for IDX Broker = 3.3.0 versions...
CVE-2026-81788
CVE-2026-81788 affects the WordPress IMPress for IDX Broker plugin in versions
EUVD-2026-75521
Subscriber Broken Access Control in IMPress for IDX Broker = 3.3.0 versions...
CVE-2026-81786 WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce = 1.2.2 versions...
CVE-2026-81786
Unauthenticated Broken Access Control in the Thank You Page Customizer for WooCommerce WordPress plugin (versions ≤ 1.2.2 ) allows an unauthenticated remote attacker to access resources without proper authorization. The vulnerability carries a CVSS 3.1 base score of 7.5 (HIGH) , with high confide...
EUVD-2026-75519
Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce = 1.2.2 versions...
CVE-2026-81785
CVE-2026-81785 affects the WordPress BuddyForms plugin , versions 2.9.0 and earlier . The vulnerability is an unauthenticated Broken Access Control flaw, meaning an attacker can exploit it over the network without any credentials or user interaction. The CVSS v3.1 score is 6.5 (Medium) , with low...
EUVD-2026-75518
Unauthenticated Broken Access Control in BuddyForms = 2.9.0 versions...
CVE-2026-81785 WordPress BuddyForms plugin <= 2.9.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in BuddyForms = 2.9.0 versions...
CVE-2026-78536 WordPress Robokassa payment gateway for Woocommerce plugin <= 1.8.9 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce = 1.8.9 versions...
EUVD-2026-75513
Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce = 1.8.9 versions...
CVE-2026-78536
CVE-2026-78536 affects the Robokassa payment gateway for Woocommerce WordPress plugin in versions 1.8.9 and earlier . The vulnerability is an unauthenticated Broken Access Control , meaning an attacker with no prior credentials can exploit it over the network. The CVSS 3.1 score is 6.5 (Medium) w...
CVE-2026-88891
OpenPanel fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private...
CVE-2026-88864
Capgo capgo.app fails to restrict direct write access to the public.ssoproviders table exposed through Supabase PostgREST. A holder of an ordinary Capgo full API key can insert a row with status='active' and enforcesso=true, bypassing the intended backend SSO provisioning route...
CVE-2026-88862
Capgo capgo.app backend through 12.242.4 does not validate parent-child delegation when processing the x-limited-key-id header. checkKeyByIdPg in supabase/functions/backend/utils/honomiddleware.ts resolves the attacker-supplied numeric API key ID using only the key ID, its expiration state, and t...
CVE-2026-88863
capgo.app npm package capgo through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite function of supabase/functions/backend/private/invitenewusertoorg.ts. The POST /private/invitenewusertoorg endpoint only requires the org.updateuserroles...
CVE-2026-21017-LDAP-Anonymous-Bind-Privilege-Escalation
CVE-2026-21017 – Escalada de Privilegios por Bind Anónimo LDAP Código del programa simulación Python ldap3 root@kitploit: ldapanonsim.py - LDAP server allowing anonymous bind with write access from ldap3 import Server, Connection, ALL Simulated: real server would be misconfigured server =...
CVE-2026-70481
CVE-2026-70481 Open WebUI, afectado desde 0.5.0 hasta 0.10.2, parcheado en 0.11.0. Moderado, CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, CWE-284 y CWE-862. En backend/openwebui/routers/channels.py los manejadores de actualización y eliminación de mensajes se ramifican según el tipo de...