WordPress Smart Admin Assistant – Dashboard and Site Enhancements plugin <= 2.2.0 - Cross-Site Scripting vulnerability

Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Smart Admin Assistant versions = 2.2.0...

BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins

Cybersecurity researchers have warned of a supply chain compromise impacting WordPress plugin vendor BdThemes, prompting the content management systems CMS platform's plugins team to temporarily disable their downloads. "Unlike traditional software supply chain attacks, zero source code files wer...

[SECURITY] [DSA 6429-1] caddy security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6429-1 [email protected] https://www.debian.org/security/ Aron Xu August 11, 2026 https://www.debian.org/security/faq -...

Myndr: Myndr CORS Misconfiguration

The CORS configuration on admin.myndr.net allowed any .myndr.net subdomain to read authenticated admin panel responses, including CSRF nonces and session data. This vulnerability could have been exploited to take over admin accounts...

CVE-2026-24329

A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the Management Model. This injection causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml...

CVE-2026-24329 Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user.

A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the Management Model. This injection causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml...

GHSA-5QJQ-93H5-HRGP vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-66772

SAP BusinessObjects Business Intelligence Platform Admin Tools does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. Th...

EUVD-2026-55884

SAP BusinessObjects Business Intelligence Platform Admin Tools does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. Th...

CVE-2026-66772

CVE-2026-66772 concerns SAP BusinessObjects BI Platform (Admin Tools), where a missing authorization check on certain administrative functionality lets an authenticated non-administrative user bypass restrictions to glean limited information about the affected feature. The impact is described as ...

CVE-2026-66772 Missing Authorization Check in SAP BusinessObjects Business Intelligence Platform (Admin Tools)

SAP BusinessObjects Business Intelligence Platform Admin Tools does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. Th...

CVE-2026-66772 Missing Authorization Check in SAP BusinessObjects Business Intelligence Platform (Admin Tools)

SAP BusinessObjects Business Intelligence Platform Admin Tools does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated as a non-administrative user could bypass this restriction to gain limited information about affected functionality. Th...

CVE-2026-11734: Stack-based Buffer Overflow

A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected device to become temporarily unavailable...

PT-2026-70914

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

PT-2026-70148

Name of the Vulnerable Software and Affected Versions Intelliants Subrion CMS versions prior to 4.2.2 Description An authenticated administrator can delete arbitrary files on the server through the admin panel file deletion endpoint. This occurs because the endpoint passes a user-supplied file pa...

Debian dsa-6429 : caddy - security update

The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6429 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6429-1 [email protected] https://www.debian.org/securit...

PT-2026-70044

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform Admin Tools affected versions not specified Description Insufficient authorization checks in certain administrative functionality allow an authenticated non-administrative user to bypass...

PT-2026-70197

Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create Twig function restricts class instantiation using a 5-entry blocklist that does not include SplFileObject, allowing an authenticated administrator with allowAdminChanges=true to...

CVE-2026-15606: Missing Authorization

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-69102: Use of Hard-coded Credentials

MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login endpoint. Attackers can craft a JWT...