CVE-2026-24329

A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the Management Model. This injection causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml...

CVE-2026-14526 AI Copilot – Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation via Custom Workflow Route

The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to creat...

GHSA-9P7C-V5X3-RFX8 Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets

The reorder-sets action in Craft CMS’s GlobalsController is missing the requireAdmin check that the adjacent save-set and delete-set actions both enforce. Any authenticated control panel user can POST to /actions/globals/reorder-sets and permanently reorder all global sets in the project config,...

CVE-2026-7327

The CVE covers Progress MarkLogic Server REST API: an improper privilege management in the REST API document processing pipeline allows an authenticated user with an administrative REST role to escalate privileges, potentially exposing sensitive server-side data. Affected versions are MarkLogic S...

CVE-2026-70491

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. In 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/id endpoints in backend/openwebui/routers/tools.py returned full Python tool source to authenticated non-admin...

PYSEC-2026-3601 Open WebUI: Arena task endpoints can bypass underlying model access controls

Summary An authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions. The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected...

CVE-2026-67356 ArcadeDB before 26.7.3 Privilege Escalation via JavaScript Trigger

ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity.createUser without permission checks. Attackers with UPDATESCHEMA permission can create triggers that execute JavaScript to create server-wid...

CVE-2026-45376 Decidim: Admin user search allows SQL injection through similarity-based sorting

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params:term into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated...

CVE-2026-45376 Decidim: Admin user search allows SQL injection through similarity-based sorting

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params:term into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated...

CVE-2026-45376 Decidim: Admin user search allows SQL injection through similarity-based sorting

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params:term into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated...

SUSE CVE-2026-40304

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the unaccess handler controller/unaccess.go contains a logical error in its ownership guard: when a frontend record has environmentid = NULL the marker for admin-created global frontends, the conditio...

CVE-2026-17568

Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request. This issue affects : Devolutions Serv...

EUVD-2026-49377

Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request. This issue affects : Devolutions Serv...

PT-2026-65106

Name of the Vulnerable Software and Affected Versions JFrog affected versions not specified Description Incorrect authorization validation in the refresh token signature allows users without administrative privileges to obtain a signed JFrog administrator token, leading to potential privilege...

GHSA-M3QF-58WF-W979 Open WebUI: Arena task endpoints can bypass underlying model access controls

Summary An authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions. The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected...

Incorrect Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization through the meta.knowledge process. An attacker can gain unauthorized write or delete access to files belonging to other users by attaching a file ID, for which they only have read...

EUVD-2026-45885

The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting that executes in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link...

Exploit for CVE-2026-63030

CVE-2026-63030 - WordPress REST API Batch Route Confusion PoC...

Exploit for CVE-2026-60137

wp2shell Pre-authentication Remote Code Execution against Wor...

CVE-2026-48010 Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, UserController::upsertUser in src/Core/Framework/Api/Controller/UserController.php writes raw user data in SYSTEMSCOPE without filtering the admin field, so a non-admin API user with user:create or user:update ACL permission...