316 matches found
CVE-2026-81902 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup
Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action removeOrphanedBlocks. A remote attacker could craft a request that, when loaded by an authenticated user holding edit permission on the target page, deleted every block on that page's current...
CVE-2026-81902 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup
Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action removeOrphanedBlocks. A remote attacker could craft a request that, when loaded by an authenticated user holding edit permission on the target page, deleted every block on that page's current...
CVE-2026-50173 Flow-Like: Azure invoke presign grants app content write SAS to ExecuteEvents-only users
Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, GET /api/v1/apps/appid/invoke/presign grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has ExecuteEvents, even when that member lacks ReadFiles and...
CVE-2026-73356
Unauthenticated Arbitrary Content Deletion in Breeze = 2.5.12 versions...
CVE-2026-73356 WordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerability
Unauthenticated Arbitrary Content Deletion in Breeze = 2.5.12 versions...
CVE-2026-73356
Unauthenticated Arbitrary Content Deletion in Breeze = 2.5.12 versions...
CVE-2026-73356
The Breeze WordPress plugin (versions
CVE-2026-18316 Solace Extra <= 1.6.0 - Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip AJAX Action
The Solace Extra plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the importzip function in versions up to, and including, 1.6.0. The handler is registered on both wpajaxaction-import-zip and wpajaxnoprivaction-import-zip and on...
WordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerability
Arbitrary Content Deletion vulnerability discovered by Asim Alshaya in WordPress Plugin Breeze versions = 2.5.12...
CVE-2026-28173
Customer Arbitrary Content Deletion in WP Event SOlution = 4.1.19 versions...
CVE-2026-28173 WordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerability
Customer Arbitrary Content Deletion in WP Event SOlution = 4.1.19 versions...
CVE-2026-28173
The CVE-2026-28173 entry concerns the WordPress WP Event Solution plugin, versioned ≤ 4.1.19, with a vulnerability described as Customer Arbitrary Content Deletion. Supported details indicate a high-severity issue (CVSS 3.1: 7.1) with network attack vector, low attack complexity, and low privileg...
EUVD-2026-57956
Customer Arbitrary Content Deletion in WP Event SOlution = 4.1.19 versions...
PT-2026-71522
Customer Arbitrary Content Deletion in WP Event SOlution = 4.1.19 versions...
CVE-2026-16948
The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and...
CVE-2026-16948 Solace Extra < 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wide Nonce Exposure
The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and...
PYSEC-2026-3526 PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API
Summary A workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role chec...
EUVD-2026-48183
Subscriber Arbitrary Content Deletion in WP EasyPay = 4.5.0 versions...
