EUVD-2026-92776

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissions! but do not apply the share link's pages restriction. A holder of a page-scoped share link can retrieve comment threa...

CVE-2026-105684 Penpot: Share-link page-scope escape — comment RPCs leak comment content, author identity, and all page-ids for pages outside the share scope

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissions! but do not apply the share link's pages restriction. A holder of a page-scoped share link can retrieve comment threa...

CVE-2026-105681 Ghost: Authorization Bypass in Comments Feature

Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1...

CVE-2026-105681 Ghost: Authorization Bypass in Comments Feature

Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1...

CVE-2026-105681 Ghost: Authorization Bypass in Comments Feature

Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1...

CVE-2026-105681

The Ghost Node.js content management system is affected by an authorization bypass vulnerability in its comments feature. An input validation issue allows authenticated members to access comments for which they lack proper authorization. This vulnerability affects versions 5.9.0 through 6.44.1 . ...

CVE-2026-104966

Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH...

EUVD-2026-92488

Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH...

CVE-2021-44217

CVE-2021-44217 Suggested description In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting XSS vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API...

WordPress Delete All Comments of wordpress plugin <= 7.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by mamgad in WordPress Plugin Delete All Comments of wordpress versions = 7.1...

PT-2026-106034

Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH...

PT-2026-106200

Name of the Vulnerable Software and Affected Versions Ghost versions 5.9.0 through 6.44.0 Description An input validation issue in this Node.js content management system allows members to access comments for which they lack proper authorization. Recommendations Update to version 6.44.1...

CVE-2026-105684: Exposure of Sensitive Information to an Unauthorized Actor

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissions! but do not apply the share link's pages restriction. A holder of a page-scoped share link can retrieve comment threa...

CVE-2026-105681: Improper Neutralization of Special Elements in Data Query Logic

Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1...

CVE-2026-104966: Authorization Bypass Through User-Controlled Key

Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH...

CVE-2023-47437

CVE-2023-47437 Pachno Stored Cross-Site Scripting Vulnerability https://vulners.com/cve/CVE-2023-47437 Description: A vulnerability has been identified in Pachno allowing an authenticated attacker to execute a stored cross-site scripting XSS attack. Vulnerable forms: Comments Affected Versions:...

Exploit for CVE-2026-92084

CVE-2026-92084 - Beaver Builder Arbitrary Shortcode Execution...

CVE-2026-92084

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before...

EUVD-2026-91966

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before...

PT-2026-104552

Name of the Vulnerable Software and Affected Versions The Beaver Builder Page Builder – Drag and Drop Website Builder versions prior to 2.11.0.6 Description The plugin allows unauthenticated attackers to execute arbitrary shortcodes because the software fails to properly validate a value before...