Lucene search
+L

318621 matches found

NVD
NVD
added 2026/09/17 11:17 a.m.4 views

CVE-2026-92893

A flaw was found in the foremanansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's viewhosts permission. An authenticated user whose host visibility is restricted by a...

4.3CVSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/17 11:16 a.m.1 views

EUVD-2026-81436

AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality against an uninitialized session variable. Attackers with a victim's password can bypass the second factor by sending a parameter-less G...

8.6CVSS
SaveExploits0References2
CVE
CVE
added 2026/09/17 11:16 a.m.4 views

CVE-2026-92914 AVideo LoginControl PGP Second Factor Authentication Bypass

AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality against an uninitialized session variable. Attackers with a victim's password can bypass the second factor by sending a parameter-less G...

8.6CVSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/17 11:16 a.m.3 views

CVE-2026-92914 AVideo LoginControl PGP Second Factor Authentication Bypass

AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality against an uninitialized session variable. Attackers with a victim's password can bypass the second factor by sending a parameter-less G...

8.6CVSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/17 10:28 a.m.5 views

CVE-2026-92893 Rubygem-foreman_ansible: ansible inventory api ignores view_hosts permission filters, exposes hidden parameters

A flaw was found in the foremanansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's viewhosts permission. An authenticated user whose host visibility is restricted by a...

4.3CVSS
SaveExploits0References2
CVE
CVE
added 2026/09/17 10:28 a.m.7 views

CVE-2026-92893

A flaw was found in the foremanansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's viewhosts permission. An authenticated user whose host visibility is restricted by a...

4.3CVSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/17 10:28 a.m.4 views

EUVD-2026-81418

A flaw was found in the foremanansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's viewhosts permission. An authenticated user whose host visibility is restricted by a...

4.3CVSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2026/09/17 9:25 a.m.2 views

CVE-2026-92893

A flaw was found in the foremanansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's viewhosts permission. An authenticated user whose host visibility is restricted by a...

4.3CVSS
SaveExploits0References3
Microsoft CVE
Microsoft CVE
added 2026/09/17 8:07 a.m.3 views

mtd: rawnand: validate ONFI extended parameter page sections

...

SaveExploits0
NVD
NVD
added 2026/09/17 7:16 a.m.4 views

CVE-2026-87963

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...

8.6CVSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/17 7:05 a.m.5 views

CVE-2026-87963 Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...

8.6CVSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/17 7:05 a.m.3 views

EUVD-2026-81385

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...

8.6CVSS
SaveExploits0References1
CVE
CVE
added 2026/09/17 7:05 a.m.11 views

CVE-2026-87963

The Yo WordPress plugin (versions 1.1 through 1.3.1 ) is affected by an unauthenticated SQL injection vulnerability. The plugin does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its built-in request escaping. An ...

8.6CVSS
SaveExploits0References1
GithubExploit
GithubExploit
added 2026/09/17 6:53 a.m.10 views

Exploit for CVE-2026-67401

CVE-2026-67401 — cPanel/WHM EmailTrack SQL Injection → Root RC...

9.9CVSS0.0104EPSS
SaveExploits3
NVD
NVD
added 2026/09/17 6:16 a.m.4 views

CVE-2026-91010

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it, allowing any authenticated user, such as a...

SaveExploits0References1
EUVD
EUVD
added 2026/09/17 6:00 a.m.6 views

EUVD-2026-81353

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it, allowing any authenticated user, such as a...

SaveExploits0References1
CVE
CVE
added 2026/09/17 6:00 a.m.12 views

CVE-2026-91010

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 is vulnerable to arbitrary form submission deletion. The plugin's message deletion AJAX action does not check the user's capabilities and only tests that a nonce parameter is present rather than ...

SaveExploits0References1
Cvelist
Cvelist
added 2026/09/17 6:00 a.m.9 views

CVE-2026-91010 Invisible Anti-Spam & CAPTCHA < 5.1.1 - Subscriber+ Arbitrary Form Submission Deletion

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it, allowing any authenticated user, such as a...

SaveExploits0References1
Cvelist
Cvelist
added 2026/09/17 6:00 a.m.10 views

CVE-2026-90923 Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...

SaveExploits0References1
Cvelist
Cvelist
added 2026/09/17 6:00 a.m.5 views

CVE-2026-86707 Private Feed Key <= 0.1 - Unauthenticated Authentication Bypass via 'feedkey' Parameter

The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...

SaveExploits0References1
Rows per page
Query Builder