116072 matches found
PT-2026-60720
The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability which could allow unauthenticated users to perform Stored Cross-Site Scripting...
PT-2026-60917
Name of the Vulnerable Software and Affected Versions Kyverno versions 1.18.0 through 1.18.1 Description In the NamespacedMutatingPolicy CEL compiler, the generator library is exposed to matchConditions, allowing a namespace-scoped policy to invoke the generator.applynamespace, resources function...
Schneider Electric Cybersecurity Admin Expert Privilege Escalation
The vulnerability of Schneider Electric’s Security Management Software, EcoStruxure Cybersecurity Admin Expert CAE, is related to insufficient protection for registration data. Exploiting this vulnerability can allow attackers to enhance their privileges...
SearchUsersPermissions returns cross-org users
This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET...
PT-2026-65341
Formie contains a missing authorization vulnerability in administrative settings routes. An authenticated, non-admin Craft CMS control panel user with limited Formie access could directly access Formie settings pages and modify global plugin configuration. In affected versions, Formie...
CVE-2026-52348
cool-admin-java 8.0.0 has a SQL injection vulnerability in the order method of CrudOption.java...
PT-2026-60793
Name of the Vulnerable Software and Affected Versions Maybe versions prior to 0.6.0 Description Authenticated users with low-privilege member roles can access and modify global hosting settings. This occurs because the ensure admin filter is only applied to the clear cache action within the...
Hikvision HikCentral Professional has an unknown vulnerability (CNVD-2026-28554)
Hikvision HikCentral Professional is a professional edition of the AI Cloud-based application management platform designed for edge domains by Hikvision, a Chinese company. Hikvision HikCentral Professional has a security vulnerability that stems from access control issues. Attackers can exploit...
CVE-2026-16106: Insufficient Granularity of Access Control
A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can...
CVE-2026-62207: Missing Authorization
OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability that allows lower-trust callers to reach admin-scoped tools. Attackers can perform actions requiring stronger authorization by exploiting insufficient policy checks on configured input paths...
CVE-2026-42168
django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmdreceive and cmdsend fields on the Partner model. These fields are passed directly to os.system in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when ...
PT-2026-60801
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the admin REST API of Keycloak, an identity and access management solution. The issue occurs when a delegated administrator attempts to remove a child role from a composite...
CVE-2026-62235: Missing Authorization
Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api.access permission to perform unauthorized CRUD operations on permission-less directories. Attackers with api.access credentials can create...
CVE-2026-48009: Exposure of Sensitive Information to an Unauthorized Actor
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a low-privilege admin user with userrecovery:read ACL can take over any admin account by triggering POST /api/action/user/user-recovery, reading the password recovery hash through POST /api/search/user-recovery, and using PAT...
PT-2026-60853
Name of the Vulnerable Software and Affected Versions Xenforo version 2.3.8 Description A Server-Side Request Forgery SSRF issue exists where users with administrator privileges or the ability to add and save RSS feeds can enumerate internal services and ports or expose the server's original IP...
CVE-2026-52348
cool-admin-java 8.0.0 has a SQL injection vulnerability in the order method of CrudOption.java...
CVE-2026-43978
wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can escalate their session to any higher-privileged account gym manager, general manager by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a...
CVE-2026-58643
Improper neutralization of input during web page generation 'cross-site scripting' in Windows Admin Center allows an unauthorized attacker to perform spoofing over a network...
EUVD-2026-45066
wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can escalate their session to any higher-privileged account gym manager, general manager by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a...