CVE-2026-74929

The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards...

CVE-2025-68613

CVE-2025-68613 — n8n कामप्रवाह स्वचालन अभिव्यक्ति इंजिन पृथक्करण विफलता लेखक इस शोध के दुरुपयोग या क्षति के लिए कोई जिम्मेदारी नहीं लेता है केवल शैक्षिक और रक्षात्मक उद्देश्यों के लिए प्रदान किया गया है विवरण इस रिपॉजिटरी में एक प्रयोगशाला-स्तरीय विश्लेषण और भेद्यता CVE-2025-68613 के लिए एक...

PT-2026-82359

In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with include subtree to the GET /v3/role assignments endpoint. The domain's project record has...

PT-2026-82334

Name of the Vulnerable Software and Affected Versions KubePi versions prior to 2.0.1 Description Cluster-scoped APIs do not consistently validate per-cluster access. This allows an authenticated user with cluster management permissions to operate on clusters outside their granted scope. Because t...

PT-2026-82103

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 12.8 through 19.1.6 GitLab CE/EE versions 19.2 through 19.2.4 GitLab CE/EE versions 19.3 through 19.3.0 Description An issue exists where an authenticated user can cause a denial of service affecting background job...

Linux Distros Unpatched Vulnerability : CVE-2026-48549

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie...

CVE-2026-38474

GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 suffers from a Broken access control vulnerability in the IP lock manager, which allows remote authenticated users to add, modify, or delete IP lock entries for arbitrary accounts via tools.php?action=iplock...

CVE-2026-38470

A Broken access control vulnerability in the API user endpoint in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows unprivileged, authenticated users to enable or disable arbitrary user accounts via the req=disable or req=enable action using a normal user-created...

CVE-2026-73180

Apache Tomcat is affected by an insufficient session expiration flaw. If the session ID of an authenticated HTTP session is changed after a WebSocket connection has been established under that session, the WebSocket session is not closed when the HTTP session ends, as required by the Jakarta WebS...

sudowp-crowdsignal-forms

SudoWP Crowdsignal Forms Questo è un fork di sicurezza SudoWP del plugin originale Crowdsignal Forms. !WARNING Avviso di sicurezza : il plugin originale "Crowdsignal Forms" versioni = 1.7.2 contiene una vulnerabilità critica di autorizzazione mancante CVE-2025-69015 che consente a utenti...

EUVD-2026-65609

NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject code by sending a specially crafted API request. A successful exploit of this vulnerability might lead to code execution, escalation of privileges and...

CVE-2026-69104

An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue...

CVE-2026-20769

A flaw was found in the Intel NPU Driver. An unprivileged software adversary with an authenticated user can exploit an improper conditions check. This vulnerability, requiring local access and no user interaction, may lead to a denial of service on the affected system. Mitigation No mitigation is...

CVE-2026-78581

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier t...

EUVD-2026-65448

Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data...

CVE-2026-12878

In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions...

CVE-2026-49845

CVE-2026-49845 is a SQL injection in Apache Hive before 4.2.1 affecting the Hive Metastore's direct-SQL partition-name resolution paths. The root cause is that client-supplied partition names are embedded into SQL via string concatenation (DirectSqlUpdatePart.quoteString()) rather than bind param...

CVE-2026-77127 Information Disclosure in extension "Modules" (modules)

The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an error response that discloses the current databa...

CVE-2026-77139

CVE-2026-77139 is a path traversal vulnerability in the Mask (mask) extension for TYPO3 . The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask m...

EUVD-2026-65337

The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files...