115848 matches found
Information Exposure
Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Information Exposure through the OIDCClientSecretConfigWrapper in...
CVE-2026-1372
The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the activatetutorfree and activateelementorfree functions registered as adminaction handlers. This makes it possible f...
CVE-2026-1372 Tutor LMS Elementor Addons <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation
The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the activatetutorfree and activateelementorfree functions registered as adminaction handlers. This makes it possible f...
EUVD-2026-46167
The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the activatetutorfree and activateelementorfree functions registered as adminaction handlers. This makes it possible f...
CVE-2026-1372
The CVE concerns the WordPress plugins Tutor LMS Elementor Addons (
CVE-2026-11767
The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in...
CVE-2026-13439
The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier 'sid' as the password reset token store...
CVE-2026-11767
The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in...
CVE-2026-13439
The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier 'sid' as the password reset token store...
CVE-2026-64190
A flaw was found in the Linux kernel's team driver. A local attacker with CAPNETADMIN capabilities could exploit a race condition during a team device mode change. This occurs when the teamchangemode function clears internal operation pointers before safely restoring them, while the teamxmit...
CVE-2026-6952
The CVE affects Zyxel AX7501-B1 firmware up to version 5.17(ABPC.7.2)C0, where a post-authentication command injection in the LogServer component of the syslog module is possible. An authenticated administrator can execute OS commands on the device, per the description. CVSS v3.1 metrics indicate...
Exploit for CVE-2026-13156
CVE-2026-13156 — MailerSend Official SMTP Integration About...
CVE-2026-61263: Improper Access Control
Vulnerability in the Oracle Scripting product of Oracle E-Business Suite component: Scripting Admin. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Scripting. Successful...
PT-2026-61928
Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious...
📄 WordPress Invoice Creator 1.0.0 Unauthenticated Account Takeover
WordPress Invoice Creator plugin version 1.0.0 contains an unauthenticated account takeover vulnerability through Arbitrary User Email Change. A remote attacker can take over another user account. This proof of concept exploit demonstrates the vulnerable request flow against the affected plugin...
CVE-2026-60400: Improper Access Control
Vulnerability in Oracle GoldenGate component: Admin Server Executable. Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle GoldenGate...
PT-2026-62476
Name of the Vulnerable Software and Affected Versions Oracle GoldenGate versions 21.3 through 21.21 Oracle GoldenGate versions 23.4 through 23.26.1 Description An issue exists in the Admin Server Executable component that allows an unauthenticated attacker with network access via HTTPS to...
CVE-2026-60394: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in Oracle GoldenGate component: Admin Server Executable. Supported versions that are affected are 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle GoldenGate. Successful attacks of this...
📄 WordPress Login Customizer 2.5.3 Unauthenticated Account Takeover
WordPress Login Customizer plugin version 2.5.3 contains an unauthenticated administrator account takeover vulnerability through Reset-Key Poisoning. A remote attacker can take over an administrator account. This proof of concept exploit demonstrates the vulnerable request flow against the affect...
PT-2026-63313
Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The ToHook function in services/webhook/general.go decrypts the HeaderAuthorizationEncrypted field and returns the plaintext authorization header in the API response. This allows repository...