CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

114 matches found

NVD•added last week•6 views

CVE-2026-14871

osTicket versions v1.18.3 and v1.17.7 contain a Broken Object Level Authorization BOLA leading to Insecure Direct Object Reference IDOR in the AJAX ticket-management subsystem...

7.1CVSS0.00312EPSS

SaveExploits0References5

CVE•added 2026/05/20 1:25 a.m.•23 views

CVE-2026-8423

The JaviBola Custom Theme Test plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 2.0.5 due to missing/incorrect nonce validation on the options page. This allows unauthenticated attackers to change the site’s active theme by modifying the ...

4.3CVSS5.7AI score0.00179EPSS

SaveExploits0References7

Positive Technologies•added 2026/05/20 12:0 a.m.•20 views

PT-2026-42079

Name of the Vulnerable Software and Affected Versions JaviBola Custom Theme Test versions prior to 2.0.6 Description The JaviBola Custom Theme Test plugin for WordPress contains a Cross-Site Request Forgery CSRF flaw, which occurs when a web application allows an attacker to induce a user to...

4.3CVSS5.8AI score0.00179EPSS

SaveExploits0References10

GithubExploit•added 2026/05/01 11:13 a.m.•137 views

Exploit for CVE-2025-48757

cso-vibecheck Senior-CSO security audit skill for vibe-coded...

9.3CVSS7.6AI score0.00735EPSS

SaveExploits3

Positive Technologies•added 2026/03/10 12:0 a.m.•5 views

PT-2026-24619

Summary The /studiocms api/dashboard/api-tokens endpoint allows any authenticated user at least Editor to generate API tokens for any other user, including owner and admin accounts. The endpoint fails to validate whether the requesting user is authorized to create tokens on behalf of the target...

8.8CVSS5.9AI score0.00564EPSS

SaveExploits3References8

OSV•added 2026/01/27 11:34 p.m.•8 views

CVE-2026-24134 StudioCMS has an Authorization Bypass Through User-Controlled Key

StudioCMS is a server-side-rendered, Astro native, headless content management system. Versions prior to 0.2.0 contain a Broken Object Level Authorization BOLA vulnerability in the Content Management feature that allows users with the "Visitor" role to access draft content created by...

6.5CVSS5.9AI score0.00295EPSS

SaveExploits2References5