2099 matches found
CVE-2026-81926: Improper Neutralization of Input During Web Page Generation
Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returned the submitted path unmodified in its JSON response, and client-side JavaScript inserted each value into the...
CVE-2026-54724: URL Redirection to Untrusted Site
Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauthenticated attacker to create a URL on a trusted Kiwi TCMS hostname that redirects a victim to an arbitrary external domain. The trusted...
CVE-2026-84600
An authorization issue in Apple operating systems allows a malicious shortcut to send messages without user confirmation. The root cause involves a flaw in state management , which has been addressed in the latest updates. This vulnerability impacts iOS 27 , iPadOS 27 , macOS Golden Gate 27 , tvO...
CVE-2026-84600
An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. A malicious shortcut may be able to send messages without user confirmation...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: The BR/EDR JUSTWORKS method has been aligned with LE. This alignment applies from version 92516cd97fd4 onward. The BR/EDR JUST WORKS method always requests user confirmation when using LE. This behavior is...
Astra Linux – Vulnerability in Firefox and Thunderbird
When handling keypress events, an attacker might have been able to trick a user into bypassing the “Open Executable File?” confirmation dialog. This could have led to the execution of malicious code. This vulnerability affects Firefox 133, Firefox ESR 128.5, Thunderbird 133, and Thunderbird 128.5...
Astra Linux – Vulnerability in OpenSSH
OpenSSH versions prior to 10.3 omitted the confirmation of connection multiplexing for proxy-mode multiplexing sessions...
PT-2026-91649
Name of the Vulnerable Software and Affected Versions iOS versions prior to 27 iPadOS versions prior to 27 macOS Golden Gate versions prior to 27 tvOS versions prior to 27 visionOS versions prior to 27 watchOS versions prior to 27 Description An authorization issue exists due to improper state...
ROS-20260914-73-0099
The vulnerability of Google Chrome is related to a data source confirmation error. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions using a specially created HTML page...
CVE-2026-86407
The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's ema...
CVE-2026-86407
The User Registration & Membership WordPress plugin in versions before 5.2.8 contains an unauthenticated user data disclosure vulnerability. The plugin fails to verify if a visitor requesting the membership confirmation page owns the account specified in the request or if a valid registration/pur...
EUVD-2026-76955
The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's ema...
PT-2026-90794
The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's ema...
CVE-2026-86407: Exposure of Sensitive Information to an Unauthorized Actor
The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's ema...
EUVD-2026-76813
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway...
ROS-20260911-73-0207
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to a data source confirmation error. Exploiting this vulnerability can allow an attacker to disclose protected information remotely...
GO-2026-6370 Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation in github.com/semaphoreui/semaphore
Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation in github.com/semaphoreui/semaphore...
CVE-2026-87488
creationtimestamp| type| source ---|---|--- 2026-09-10 00:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv4surdd3h2b 2026-09-10 04:48:22+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260910 2026-09-10 15:07:08+00:00| seen|...