717781 matches found
CVE-2026-114741 WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users...
CVE-2026-114742 WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users...
CVE-2026-114741
The WPVR WordPress plugin versions 9.0.0 through 9.0.2 is vulnerable to an Insecure Direct Object Reference (IDOR) issue. The plugin fails to perform adequate object-level authorization checks when handling requests to read or update virtual tours. This allows users with contributor-level access ...
CVE-2026-114742
The WPVR WordPress plugin, in versions 8.3.0 through 9.0.2 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is a failure to perform object-level ownership checks when updating virtual tours. This allows users with contributor-level access or higher to modify, reconfi...
PT-2026-122946
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users...
Amazon Linux 2023 : java-21-amazon-corretto, java-21-amazon-corretto-devel, java-21-amazon-corretto-headless (ALAS2023-2026-3319)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3319 advisory. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updat...
Repairing Broken Access Control in Web Applications with LLMs: An Empirical Benchmark Study
Broken access control BAC ranks among the most severe web-application vulnerability classes, yet its automated repair remains largely unexplored. Unlike memory-safety vulnerabilities, BAC is a logic vulnerability whose repair demands a deep understanding of an application's access-control model a...
SPIP 4.4.16 SQL Injection / SSRF
SPIP version 4.4.16 and earlier contain an unauthenticated blind SQL injection in the sitemap endpoint and an authenticated SSRF issue caused by unvalidated HTTP redirect targets. Proof of concept material is included for both vulnerabilities. https://packetstorm.news/download/237466...
Ash Framework authorization issue vulnerability
Versions 2.6.22 through 2.15.2 of the Ash Framework contain an authorization issue vulnerability. This vulnerability stems from improper authorization; when upserts are skipped, multi-tenant attributes are not applied to resources, potentially allowing read access to records belonging to other...
Amazon Linux 2023 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2023-2026-3318)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3318 advisory. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updat...
Parse Platform Parse Server permission and access control issue vulnerability
Versions prior to Parse Platform Parse Server 8.6.104 and versions prior to 9.10.5-alpha.5 contain a permission and access control vulnerability. This vulnerability arises because, when generating SMS multi-factor authentication codes, the entire login request is stored with root privileges. User...
PT-2026-123122
Name of the Vulnerable Software and Affected Versions llama.cpp versions prior to b11796 Description A weakness in the Pocket-TTS component allows an out-of-bounds write when the mmproj argument is manipulated. This issue occurs within the list pockettts state slots function located in the...
Amazon Linux 2023 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2023-2026-3317)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3317 advisory. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updat...
Amazon Linux 2023 : java-1.8.0-amazon-corretto, java-1.8.0-amazon-corretto-devel (ALAS2023-2026-3315)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3315 advisory. Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updat...
PT-2026-122947
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users...
ALPINE-CVE-2026-114820
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle Graal...
CVE-2026-114820
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle Graal...
DEBIAN-CVE-2026-114820
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle Graal...
EUVD-2026-109314
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle Graal...