717884 matches found
CVE-2026-115331
The Lotus software (through version 0.10.2 ) is vulnerable to an SQL injection vulnerability. Authenticated organization users can inject SQL by providing crafted billable metric property_name or categorical filter values. These values are rendered unescaped into Jinja-generated counter, gauge, a...
CVE-2026-115331 Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric propertyname or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate...
CVE-2026-115330 Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only...
CVE-2026-115330
Lotus versions up to and including 0.10.2 are vulnerable to an SQL injection vulnerability. Authenticated organization users can execute arbitrary SQL by submitting semicolon-separated stacked statements via POST /app/metrics/ . This method bypasses first-statement-only validation, potentially al...
CVE-2026-114437
A flaw was found in chi. The ClientIPFromXFF middleware evaluates IP addresses in the X-Forwarded-For XFF HTTP header, but fails to verify that the direct incoming network connection originates from a trusted IP address range. A remote attacker who can connect directly to the server can exploit...
Qilin and INC Exploit Palo Alto VPN Flaw in Ransomware Attacks
Qilin and INC ransomware operators exploit a PAN-OS vulnerability CVE-2026-0257 to gain VPN access, then steal domain credentials…...
Vulnerabilities in Oracle Fusion Middleware
Oracle has identified several vulnerabilities in various products, including the Oracle SOA Suite, Oracle WebLogic Server, Oracle Data Integrator, Oracle Identity Manager, Oracle Access Manager, Oracle WebCenter Content, Oracle Fusion Middleware including Helidon, and Oracle HTTP Server. These...
CVE-2026-112085 webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades
webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating the Ho...
CVE-2026-112085 webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades
webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating the Ho...
CVE-2026-112085 webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades
webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configured to forward WebSockets, the server forwards non-HMR WebSocket upgrade requests to the proxy target without validating the Ho...
CVE-2026-112085
The webpack-dev-server development server is vulnerable to cross-origin WebSocket access in versions before 5.2.7 and in version 6.0.0 . The root cause is that the server forwards non-HMR WebSocket upgrade requests to a proxy target without validating Host or Origin headers, bypassing allowedHost...
WordPress WP Social Feed Gallery plugin <= 5.0.13 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Intrudify in WordPress Plugin WP Social Feed Gallery versions = 5.0.13...
CVE-2026-114699
Missing Authorization vulnerability in yoomoney ЮKassa для WooCommerce yookassa allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ЮKassa для WooCommerce: from n/a through 2.17.3...
CVE-2026-114696
Missing Authorization vulnerability in miniOrange Page Restriction WordPress WP page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress WP: from n/a through 1.6.0...
CVE-2026-114698
Authorization Bypass Through User-Controlled Key vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.0-beta.1...
CVE-2026-112312
Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF Extended: from n/a through 0.9.2.7...
CVE-2026-112218
Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.1...
CVE-2026-110894
Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2...
CVE-2026-111842
Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.5...