CVE-2026-15016

CVE-2026-15016 affects the Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions WordPress plugin. The vulnerability is a Stored Cross-Site Scripting issue in the Readonly User Field via the [pmpro_member_profile_edit] shortcode, exploitable in all versions up to and...

CVE-2026-15016 Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions <= 3.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting

The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Readonly User Field via pmpromemberprofileedit Shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization...

CVE-2026-58221

Samba AD authenticated LDAP access domain takeover...

CVE-2026-15444 Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'couponcode' parameter in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin...

CVE-2026-63303

A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash ../ sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read...

CVE-2026-58341

A flaw was found in Moodle. The actions to enable and disable group messaging did not include the necessary token to prevent a Cross-Site Request Forgery CSRF risk. A remote attacker could exploit this by tricking an authenticated user into performing unintended actions, potentially leading to...

EUVD-2026-49756

A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash ../ sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read...

CVE-2026-63303 Path Traversal in Quick.CMS

A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash ../ sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read...

CVE-2026-63302

Quick.CMS is vulnerable to Local File Inclusion LFI in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure...

EUVD-2026-49755

Quick.CMS is vulnerable to Local File Inclusion LFI in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure...

CVE-2026-63301 Denial of Service in Quick.CMS

In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce an equivalent server-side authorization check. As a result, an authenticated...

CVE-2026-11598

The Shortcodify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'name' Shortcode Attribute in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acces...

UBUNTU-CVE-2026-58222

A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller AD DC. When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search ...

CVE-2026-58216

An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's KDC password change kpasswd service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of th...

CVE-2026-58221

Samba AD authenticated LDAP access domain takeover. Samba AD low-privilege authenticated LDAP access allows modifications to internal LDB special DNs, which permits a domain takeover...

CVE-2026-58222

A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller AD DC. When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search ...

CVE-2026-11598

CVE-2026-11598 is a Stored Cross-Site Scripting vulnerability in the Shortcodify WordPress plugin, affecting all versions up to 1.4.3. The issue arises from insufficient input sanitization and output escaping for the name shortcode attribute, enabling authenticated attackers with contributor-leve...

CVE-2026-14328

The CVE-2026-14328 entry describes a Privilege Escalation in the Eazy Plugin Manager for WordPress (up to version 4.4.1). The root cause is insufficient authorization on the wp_ajax_pos_get_option AJAX handler, which returns arbitrary WordPress options via get_option() after only a localized nonc...

BIT-KIBANA-2026-63260 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated attacker with low-privilege access can trigger a denial of service condition in Kibana by sending a specially crafted, oversized request payload. Processing this...

BIT-ELK-2026-63141 Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions

Missing Authorization CWE-862 in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints...