BIT-KEYCLOAK-2026-17048 Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api

A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only...

CVE-2026-77824

Media Sweep – WordPress Media Cleaner (all versions up to and including 1.1.3 ) is affected by a SQL Injection vulnerability in the 'fields' parameter of its REST API. The root cause is insufficient escaping of the user-supplied parameter combined with lack of proper query preparation, as seen in...

CVE-2026-77824 Media Sweep <= 1.1.3 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter

The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

CVE-2026-78570 Total Donations <= 2.0.5 - Unauthenticated Privilege Escalation

The Total Donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This makes it possible for unauthenticated attackers to elevate their privileges to that of an adminsitrator...

EUVD-2026-65300

The Jawn theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator...

CVE-2026-78477

The Jawn theme for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to and including 1.4.2 , allowing an attacker to gain administrator-level access . The CVSS 3.1 base score is 9.8 (Critical) , reflecting network-accessible, low-complexity exploitation with no r...

CVE-2025-6220

Ultimate Addons per Contact Form 7 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlft forever 2: eth0...

CVE-2025-5961

CVE-2025-5961 Migrazione, Backup, Staging – WPvivid Backup & Migration 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft...

CVE-2023-6444-POC

CVE-202306444-POC Prova di concetto per la divulgazione dell'email dell'amministratore senza autenticazione CVE-2023-6444 Uso: python3 cve-2023-6444.py $URL https://vulners.com/cvelist/CVELIST:CVE-2023-6444...

CVE-2024-49328

CVE-2024-49328 WP REST API FNS ; rel="https://api.w.org/" X-Content-Type-Options: nosniff Access-Control-Expose-Headers: X-WP-Total, X-WP-...

CVE-2026-74252

XSS Armazenado no Checkout de Convidado do J2Commerce via Bypass do Filtro de Cookie J2Commerce comj2store ≤ 4.1.5 — Atacante não autenticado armazena payload XSS que é executado automaticamente no navegador do administrador ao carregar a página RESUMO O J2Commerce 4.1.5 é vulnerável a Cross-Site...

CVE-2026-78414

A cross-site scripting (XSS) vulnerability exists in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 (Linux, Windows, macOS). An adjacent-network attacker who controls a rogue Nx server on the same network segment can set that server's site name to a script p...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nvmet: A possible leak has been fixed when destroying a ctrl during qp establishment. In nvmetsqdestroy, we capture sq-ctrl early. If it is not NULL, we know that a ctrl was allocated during the admin connect request handling. We...

AddUser-SAMR

AddUser-SAMR Crea amministratori locali utilizzando l'API SAMR, operando a un livello più basso di net.exe, New-LocalUser di PowerShell o dell'API NetUserAdd. Richiede privilegi di amministratore e se l'utente esiste, viene aggiunto al gruppo ma la password non viene aggiornata. Ci sono 4...

PT-2026-80899

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

CVE-2026-30512

A local privilege escalation vulnerability exists in the Restricted Access (Kiosk) Mode of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5 . The flaw resides in the external PDF viewer used to display the application manual and its interaction with the underlying Windows operating system . An...

CVE-2026-78155

privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges...

EUVD-2026-64648

privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges...

PT-2026-79767

privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges...

CVE-2026-75796

The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network,...