6735 matches found
EUVD-2026-37468
Subscriber Arbitrary Content Deletion in WPAMS 49.5.3 versions...
EUVD-2025-210212
Netskope was notified about a potential gap in its Netskope Client for Windows systems where a malicious insider with administrative privileges can potentially tamper with the customer IOCTL by sending crafted IOCTL requests to the driver. A successful exploit can result in the bypassing of all...
EUVD-2025-210211
Netskope is notified about a potential gap in its Netskoped Client for Windows systems where a malicious insider with admin privileges can lead to bypassing the NSClient Tamper Protections due to weak Discretionary Access Control List DACLs on the service object and related registry keys,. Produc...
CVE-2026-20265
Splunk AI Toolkit has a vulnerability in versions below 5.7.4 where a low-privilege user (not admin/power) can cause the toolkit to issue outbound HTTP requests to an attacker-controlled server due to an insecure default domain allowlist. This could enable data exfiltration. Root cause: outbound ...
CVE-2026-20265 Insecure Default Domain Allowlist in Splunk AI Toolkit
In Splunk AI Toolkit versions below 5.7.4, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause the Splunk AI Toolkit to make outbound requests over HTTP to a server that an attacker controls, which could allow for data exfiltration. The vulnerability exists...
CVE-2025-15657
Unauthenticated Insecure Direct Object References IDOR in School Management = 93.1.0 versions...
CVE-2026-54811
Unauthenticated SQL Injection in WP eMember v10.9.4 versions...
CVE-2026-42629
Unauthenticated Broken Authentication in PowerPack Pro for Elementor v2.13.0 versions...
CVE-2026-41557
Unauthenticated Cross Site Scripting XSS in Kapee 1.7.1 versions...
CVE-2026-24611
Unauthenticated Broken Access Control in MetForm Pro = 3.9.1 versions...
CVE-2026-22338
Unauthenticated Local File Inclusion in EcoBlue = 1.15 versions...
CVE-2025-15641
Netskope was notified about a potential gap in its Netskope Client for Windows systems where a malicious insider with administrative privileges can potentially tamper with the customer IOCTL by sending crafted IOCTL requests to the driver. A successful exploit can result in the bypassing of all...
CVE-2025-15642
Netskope is notified about a potential gap in its Netskoped Client for Windows systems where a malicious insider with admin privileges can lead to bypassing the NSClient Tamper Protections due to weak Discretionary Access Control List DACLs on the service object and related registry keys,. Produc...
CVE-2026-49108
The CVE concerns WordPress Moderno theme versions prior to 1.43, where an unauthenticated PHP Object Injection vulnerability exists in the Moderno theme. The root cause is a PHP object injection flaw within the theme (exploitable without authentication). CVSS details indicate a critical impact (C...
EUVD-2026-37685
Unauthenticated PHP Object Injection in Alukas 3.0.0 versions...
CVE-2026-39445 WordPress Alukas theme < 3.0.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Alukas 3.0.0 versions...
CVE-2026-39445
Affected: WordPress theme Alukas prior to v3.0.0. Vulnerability: PHP Object Injection in versions
CVE-2026-54811 WordPress WP eMember plugin < v10.9.4 - SQL Injection vulnerability
Unauthenticated SQL Injection in WP eMember v10.9.4 versions...