19771 matches found
CVE-2026-79758 Termix: Authenticated users can read other users' host status and clear global SSH connections
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix users can access the server-stats API without per-host authorization. GET /status returns statuses for hosts the requester cannot access, GET...
EUVD-2026-86157
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix users can access the server-stats API without per-host authorization. GET /status returns statuses for hosts the requester cannot access, GET...
CVE-2026-79758
The Termix web-based server management platform (versions 1.8.0 through 2.5.1 ) contains a vulnerability where authenticated users can access the server-stats API without per-host authorization. Specifically, the src/backend/ssh/server-stats.ts routes allow users to view host online/offline statu...
CVE-2026-97311
A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileg...
WordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Mor Golan in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.29...
WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Bookly versions = 28.2...
WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Asim Alshaya in WordPress Plugin Blocksy Companion versions = 2.1.55...
WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability
Broken Authentication vulnerability discovered by Abdelrhman Allam in WordPress Plugin GiveWP versions = 4.16.9...
CVE-2026-82849
The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is...
EUVD-2026-85809
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street...
CVE-2026-88847
The MasterStudy LMS WordPress Plugin (versions before 3.7.50 ) is vulnerable to an authentication bypass flaw where it fails to verify if a user is enrolled in a course before recording lesson completions. This allows any authenticated user , such as a subscriber, to create unauthorized course pr...
EUVD-2026-85803
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flows, allowing unauthenticated users to create accounts, and be logged into them, on sites wher...
CVE-2026-97177
A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...
PT-2026-97917
Name of the Vulnerable Software and Affected Versions Termix versions 1.8.0 through 2.5.0 Description Authenticated users can access the server-stats API without per-host authorization, failing to preserve tenant isolation. The affected routes in src/backend/ssh/server-stats.ts allow users to vie...
PT-2026-97918
Name of the Vulnerable Software and Affected Versions Termix versions 1.7.0 through 2.5.0 Description Termix is a web-based server management platform providing SSH terminal, tunneling, and file editing. The POST '/credentials/:id/deploy-to-host' endpoint fails to verify if the records associated...
CVE-2026-95604
Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...
CVE-2026-95527
Unauthenticated Broken Access Control in Conekta Payment Gateway = 6.2.4 versions...
CVE-2026-94679
Subscriber Broken Access Control in Fluent Support = 2.3.2 versions...