61155 matches found
CVE-2026-14826
The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including...
CVE-2026-19709
The Membership For WooCommerce WordPress plugin before 3.1.2 contains an unauthenticated data disclosure vulnerability in its REST API authentication logic. The plugin fails to verify that an API consumer secret has actually been generated before comparing it against the value supplied in a reque...
EUVD-2026-62291
The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...
CVE-2026-19709 Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass
The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...
CVE-2026-19406
The Easy Appointments WordPress plugin before 4.0.1 exposes an appointment-listing REST endpoint without per-user scoping, letting contributor-level accounts read all site bookings including customer names, schedules, and statuses. Fix is to upgrade to version 4.0.1 or later. No in-the-wild explo...
CVE-2026-14826 Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR
The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including...
CVE-2026-14826
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 lacks per-object ownership checks on REST routes, allowing contributor-level users to read other users' quiz notification recipient addresses via IDOR. Exploitation details are not provided. Upgrade to QSM 11.2.4 to remediate.
EUVD-2026-62266
The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including...
CVE-2026-55984
A flaw was found in Gitea. An authenticated attacker could exploit a null pointer dereference within the AddTime API. This can lead to a denial of service DoS, making the application unavailable to legitimate users...
GHSA-2QJ4-MMR9-4V2F vulnerabilities
Vulnerabilities for packages: management-api-for-apache-cassandra-5.0, thingsboard, celeborn, trino, pinot-fips, apache-hop-fips, pinot, hadoop-fips, management-api-for-apache-cassandra-4.1, tez, seata...
CVE-2026-59902 vulnerabilities
Vulnerabilities for packages: management-api-for-apache-cassandra-5.0, thingsboard, celeborn, trino, pinot-fips, apache-hop-fips, pinot, hadoop-fips, management-api-for-apache-cassandra-4.1, tez, seata...
GHSA-2QJ4-MMR9-4V2F vulnerabilities
Vulnerabilities for packages: tez, management-api-for-apache-cassandra-5.0, celeborn, trino, thingsboard...
CVE-2026-59903 vulnerabilities
Vulnerabilities for packages: apicurio-registry, zipkin, keycloak, thingsboard, opensearch, tez, wildfly, management-api-for-apache-cassandra-5.0, apache-activemq-artemis, wavefront-proxy, trino, apache-pulsar, druid, akhq, infinispan, neo4j...
PT-2026-78504
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.5, Wazuh Manager allows a low-privilege read-only API user with manager:read permission to retrieve the cluster key from the element in ossec.conf through GET...
PT-2026-78393
Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.7 Description Insufficient enforcement of the CONFIGURATION EDIT permission on administrative API read endpoints allows any authenticated user to access sensitive administrative data. By utilizing a valid session...
PT-2026-78391
Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.6 Description Failure to validate the security.enableRegistration setting in API endpoints allows the creation of user accounts even when registration is disabled. This bypasses the restriction enforced on the HT...
EUVD-2026-62482
An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to obtain sensitive information via the apivedo/chat endpoint and the utentechat parameter...
Linux Distros Unpatched Vulnerability : CVE-2026-74959
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154,...
