EUVD-2026-74687

The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnlloadpayment' AJAX action for both authenticated and unauthenticated wpajaxnopriv users and the underlying addofferproducttocart...

CVE-2026-84908

The WPFunnels WordPress plugin (versions ≤ 3.12.13 ) is vulnerable to Missing Authorization in its wpfnl_load_payment AJAX action, which is registered for both authenticated and unauthenticated users. The underlying add_offer_product_to_cart() function performs no nonce verification, no capabilit...

CVE-2026-84908 WPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Action

The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnlloadpayment' AJAX action for both authenticated and unauthenticated wpajaxnopriv users and the underlying addofferproducttocart...

CVE-2026-19946 Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter

The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpasdomrdenyuser function, which unlike its counterpart wpasdomractivateuser does not enforce currentusercan'editusers' or...

CVE-2026-19946

The Awesome Support plugin for WordPress (versions up to and including 6.3.9 ) contains a Missing Authorization flaw in the wpas_do_mr_deny_user() function. Unlike its counterpart wpas_do_mr_activate_user(), this function fails to enforce a current_user_can('edit_users') capability check, relying...

EUVD-2026-74686

The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpasdomrdenyuser function, which unlike its counterpart wpasdomractivateuser does not enforce currentusercan'editusers' or...

CVE-2026-35045-PoC

CVE-2026-35045 — Tandoor Recipes におけるオブジェクトレベル認可の欠陥 概要 Tandoor Recipes v2.6.1 の PUT /api/recipe/batchupdate/ エンドポイントは、スペース内の任意の認証済みユーザー がそのスペース内の任意のレシピ（他のユーザーが所有するプライベートレシピを含む）を変更することを許可します。これにより、すべての標準的な単一レシピエンドポイントで強制されるオブジェクトレベル認可チェックが完全にバイパスされます。 根本原因は Django REST Framework の動作上のギャップです :...

CVE-2026-21086

Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration...

CVE-2026-11821

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CYBERDUDEBIVASH-ServiceNow-AI-Agent-Audit-Script

CYBERDUDEBIVASH ServiceNow AI 에이전트 감사 스크립트 v1.1 2026년 1월 AI 미래를 안전하게 지키세요 – 2026 업데이트가 포함된 엔터프라이즈급 감사 도구 이 스크립트는 ServiceNow AI 에이전트를 대상으로 CVE-2025-12420과 같은 취약점, 거버넌스 공백, 컴플라이언스 위험을 감사합니다. CYBERDUDEBIVASH 제공 – 사이버보안, AI 앱, 서비스, 컨설팅을 위한 글로벌 에코시스템. 가격 : Basic $99/라이선스, Enterprise 지원/맞춤화 포함 $499+. 대...

CVE-2023-49471

CVE-2023-49471 취약점 유형 Blind SSRF 영향받는 제품 및 버전 Bar assistant / -----------------------------8290129562507108753887567115 Content-Disposition: form-data; name="images0copyright" -----------------------------8290129562507108753887567115 Content-Disposition: form-data; name="images0sort" 1 ----------...

kit-jwt

kit-jwt Кодирование и декодирование JSON Web Token JWT для Kit TOC Файлы Файл| Описание ---|--- .editorconfig| Конфигурация форматирования редактора .gitignore| Правила игнорирования Git для артефактов сборки и зависимостей .tool-versions| Версии инструментов asdf Zig, Kit LICENSE| Файл лицензии...

apple-positional-audio-codec-invalid-header

CoreAudio 패치CVE-2025-31200에 대한 개념 증명, iOS 18.4.1에서. 설명 글은 https://blog.noahhw.dev/posts/cve-2025-31200/ 에 있습니다. 업데이트 2025/05/27 이를 제한된 범위이지만 임의 쓰기로까지 발전시킬 수 있었습니다. 설명 글은 곧 올라옵니다. 직접 확인하려면 패치 이전 버전의 macOS 15.4.1에서 빌드해야 합니다. check-mismatch lldb 훅을 사용하여간단한 harness로 오디오를 재생하는 방식 오디오를 재생하면 쓰기를 확인할 수...

Security Bulletin: Multiple Vulnerabilities in watsonx.data

Summary Multiple vulnerabilities were addressed in watsonx.data 2.4.0 patch 5 version, which was present in different version from watson.data 2.4.0 Vulnerability Details CVEID:CVE-2026-53537 DESCRIPTION: Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30,...

cve-2021-44228-log4shell_rce_reproduction

CVE-2021-44228 — Log4Shell: Apache Log4j2 원격 코드 실행 CVSS 10.0 치명적 | CWE-502: 신뢰할 수 없는 데이터의 역직렬화 | CWE-917: 표현식 언어 주입에 대한 부적절한 중화 개요 Log4ShellCVE-2021-44228은 2020년대 가장 심각한 취약점으로 꼽히며, Apache Log4j2 2.02.14.1 버전에 영향을 미칩니다. 2021년 11월 Alibaba Cloud Security의 Chen Zhaojun이 발견했고 2021년 12월 9일에 공개적으로 알려졌으며...

CVE-2026-21086

Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration...

EUVD-2026-74627

Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration...

CVE-2026-21086

Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration...

CVE-2026-21086

CVE-2026-21086 is an improper authorization vulnerability in the ProxyHandler component of Samsung Mobile devices prior to SMR Aug-2026 Release 1 . A local attacker with low privileges can access the proxy configuration. The Samsung Mobile CNA assigned a CVSS 4.0 base score of 4.8 (MEDIUM) with a...

Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty

Summary IBM SPSS Analytic Server is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-14525 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IB...