83564 matches found
CVE-2026-105701
The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution (RCE) in all versions up to and including 2.0.66 . The root cause is a missing capability check on the REST API form creation endpoint combined with an unsandboxed Twig environment used for rendering email templates. A...
CVE-2026-105701 ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template
The ACPT Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes ...
CVE-2026-94293 Missing authentication for critical function in the aas-edge-client REST API
An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints...
CVE-2026-94293
The aas-edge-client REST API is vulnerable to a missing authentication flaw for critical functions. An unauthenticated remote attacker can perform PATCH requests to modify Asset Administration Shell submodel data and use GET endpoints to read all exposed data. No specific exploit details or remed...
CVE-2026-94293 Missing authentication for critical function in the aas-edge-client REST API
An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints...
Exploit for CVE-2026-8206
🛡️ CVE-2026-8206: Unauthenticated Account Takeover Lab Analysi...
CVE-2026-105486
A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and...
EUVD-2026-92916
A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and...
CVE-2026-105486 OSSRS srs System API api.go systemAPI.Run missing authentication
A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and...
CVE-2026-105486
The OSSRS srs software (up to version 7.0-a1 ) contains a vulnerability in the System API component. Specifically, the systemAPI.Run function within the internal/proxy/api.go file lacks proper authentication, allowing for remote manipulation. Public exploits for this vulnerability are currently a...
CVE-2026-105486 OSSRS srs System API api.go systemAPI.Run missing authentication
A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and...
CVE-2026-26980
CVE-2026-26980 ★ CVE-2026-26980 TryGhost Ghost CMS Content API SQL Injection PoC ★ https://github.com/user-attachments/assets/e7fab29e-8382-4ecc-986c-68852c28a32c Overview CVE-2026-26980 is an unauthenticated SQL Injection vulnerability in TryGhost Ghost CMS Content API. The vulnerable path is...
CLEANSTART-2026-ON00136 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON
Security vulnerability affects the sonarqube package. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON...
CLEANSTART-2026-KW24127 flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www
Security vulnerability affects the sonarqube package. A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint https://www...
CVE-2026-105783
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...
CVE-2026-105742
A flaw was found in docling. This vulnerability can lead to information disclosure of sensitive credentials, such as API keys and session tokens. When remote image fetching is enabled, the HTML image loader fails to restrict custom request headers to the document's original domain. A remote...
CVE-2026-105758
A flaw was found in vllm. An unauthenticated remote attacker can cause a Denial of Service DoS by sending requests with excessively high video processing parameters to affected API endpoints. Because the backend does not enforce upper bounds on user-controlled video frame counts and rates, the...
CVE-2026-105756
A flaw was found in vllm. An authenticated remote attacker can cause a Denial of Service DoS by submitting an API request containing an invalid cache salt parameter with forbidden characters or excessive length. Because the application fails to validate the parameter before passing it to the...