10971 matches found
PT-2026-88224
Name of the Vulnerable Software and Affected Versions Android OS affected versions not specified Description A logic error in multiple functions of RemoteViews.java allows a bypass of background activity launch restrictions. This flaw enables local escalation of privilege without requiring...
EUVD-2026-71800
YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature checks the result of PHP's opensslverify with a loose boolean negation - if !opensslverify... throw ... . PHP's opensslverify has four possible return values: 1, 0, -1, and...
kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check
A flaw was found in the Linux kernel's nftables component. A logic bug in nftmapcatchallactivate causes an inverted element activity check during the abort path of a failed transaction. This can lead to a use-after-free vulnerability, as catchall verdict elements may still reference a freed chain...
CVE-2026-84759
Unauthenticated Cross Site Request Forgery CSRF in Activity Log = 2.13.1 versions...
EUVD-2026-69935
Unauthenticated Cross Site Request Forgery CSRF in Activity Log = 2.13.1 versions...
CVE-2026-84759 WordPress Activity Log plugin <= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Activity Log = 2.13.1 versions...
CVE-2026-84759 WordPress Activity Log plugin <= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Activity Log = 2.13.1 versions...
CVE-2026-84759
CVE-2026-84759 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Activity Log plugin by ArYo, affecting versions ≤ 2.13.1 . The flaw was discovered by Asim Alshaya and is rated CVSS 3.1: 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicati...
EUVD-2026-69920
Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with viewothertimesheet permission can list timesheets using activities restricted to teams they do not belong to,...
CVE-2026-84808 Kimai before 2.65.0 Authorization Bypass via API Timesheet
Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with viewothertimesheet permission can list timesheets using activities restricted to teams they do not belong to,...
CVE-2026-84808
Kimai (a self-hosted time-tracking application) versions before 2.65.0 are affected by an authorization bypass in the REST API timesheet collection endpoint. The vulnerability stems from a failure to enforce activity-team access controls : a user holding the view_other_timesheet permission can li...
CVE-2026-84804 Kimai before 2.65.0 Authorization Bypass via Team Activity API
Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with editteam permission can revoke team access without the required permissionsactivity check, bypassing authorization controls...
CVE-2026-84804
Kimai before version 2.65.0 contains an authorization bypass in its Team Activity API endpoints. The root cause is a missing permissions_activity check when removing team access to activities, projects, and customers: authenticated users holding only the edit_team permission can revoke team acces...
CVE-2026-84804 Kimai before 2.65.0 Authorization Bypass via Team Activity API
Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with editteam permission can revoke team access without the required permissionsactivity check, bypassing authorization controls...
WordPress Activity Log plugin <= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Asim Alshaya in WordPress Plugin Activity Log versions = 2.13.1...
CVE-2026-19251 Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity
The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation...
CVE-2026-19251
The Ultimate Member WordPress plugin versions before 2.13.0 is vulnerable to an unauthenticated information disclosure. The root cause is a failure to verify if a comment has been approved or if the associated profile is private before returning profile activity to unauthenticated visitors. This ...
CVE-2026-19251 Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity
The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation...
CVE-2026-84808: Incorrect Authorization
Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with viewothertimesheet permission can list timesheets using activities restricted to teams they do not belong to,...