167677 matches found
CVE-2026-90953: Exposure of Sensitive Information to an Unauthorized Actor
The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators...
CVE-2026-85576: Missing Authorization
The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them...
PT-2026-103055
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of the plugin's bt bb css image grid shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. Thi...
PT-2026-103065
Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information...
PT-2026-103079
Name of the Vulnerable Software and Affected Versions EasyFlow .NET affected versions not specified Description An arbitrary file read flaw allows authenticated remote attackers to download arbitrary system files from the server. Recommendations At the moment, there is no information about a newe...
PT-2026-103127
sogo yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user,...
PT-2026-103115
MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object reference add, user admin edit, the...
PT-2026-103038
The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators...
PT-2026-103031
The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them...
PT-2026-103627
Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.1 Description A reflected cross-site scripting issue exists in the back-office Transplant a module form. An attacker can craft a malicious link containing a JavaScript payload in the exceptions parameter. This...
PT-2026-103049
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa locale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute...
PT-2026-103092
Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description A missing capability check allows a low-privileged authenticated user to trigger the recalculation of grade penalties without the necessary permissions. This flaw enables unauthorized users to...
PT-2026-103318
🚨 CVE-2026-100271 In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects 🎖@cveNotify...
PT-2026-103313
🚨 CVE-2026-100266 In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address 🎖@cveNotify...
PT-2026-103499
yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...
PT-2026-103626
Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.1 Description A reflected cross-site scripting issue exists in the back-office Hotel Reservation System Book Now search. The application fails to validate the date to and id room type parameters before copying the...
CVE-2026-102138: Server-Side Request Forgery (SSRF)
An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue requests to internal network services. Exploitation...
PT-2026-103535
Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway versions prior to 9.5.0 Description An authenticated administrator can achieve Remote Code Execution by importing a configuration with contents that are not sufficiently validated before processing. A crafted...
CVE-2026-102109: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially influence that value to inject SQL. Exploitatio...