278183 matches found
WordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Asim Alshaya in WordPress Plugin Progress Planner versions = 1.10.0...
WordPress Deposits and Partial Payments for WooCommerce plugin <= 4.0.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin Deposits and Partial Payments for WooCommerce versions = 4.0.1...
WordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Sakri Koskimies in WordPress Plugin BEAR versions = 1.2.2...
[SECURITY] Fedora 45 Update: budgie-control-center-2.1.3-3.fc45
A fork of GNOME Control Center for the Budgie 10 Series...
PT-2026-106491
Name of the Vulnerable Software and Affected Versions BEAR – Bulk Editor for WooCommerce Professional versions prior to 1.2.3 Description Broken access control allows unauthenticated attackers to perform unauthorized actions. This issue occurs due to a missing capability check in a function,...
Cross-Chain Access Control for Permissioned Blockchain Interoperation
As enterprise blockchains become increasingly interconnected, access control must extend beyond the boundaries of a single network. Existing approaches mainly focus on controlling access within one blockchain, while cross-chain interactions involve multiple networks that may follow different...
PT-2026-106486
Name of the Vulnerable Software and Affected Versions Progress Planner versions prior to 1.10.1 Description The Progress Planner plugin for WordPress contains a broken access control issue. A missing capability check in a function allows authenticated users with subscriber-level permissions or...
Who Is Your Agent Serving? Provider-Side Indirect Prompt Injection in Proactive Agents
Proactive personal agents increasingly decide what to recommend, how to personalize advice, and what follow-up assistance to offer, creating a new user-decision attack surface for provider-side indirect prompt injection. We show that an external provider need not access private user context,...
WordPress WC Ukraine Shipping plugin <= 1.23.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Heinrihs Skrodelis in WordPress Plugin WC Ukraine Shipping versions = 1.23.2...
WordPress Scratch & Win – Giveaways and Contests plugin <= 3.0.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by SecondGateWP in WordPress Plugin Scratch & Win – Giveaways and Contests versions = 3.0.2...
WordPress Timetics plugin <= 1.0.63 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by dcs in WordPress Plugin Timetics versions = 1.0.63...
WordPress UsersWP plugin <= 1.2.74 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Md. Moniruzzaman Prodhan in WordPress Plugin UsersWP versions = 1.2.74...
WordPress Lookzy plugin <= 1.1.14 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by cazy in WordPress Plugin Lookzy versions = 1.1.14...
Security Bulletin: Due to the use of Apache Ant, IBM Sterling Control Center is vulnerable to Relative Path Traversal (CVE-2026-78254)
Summary Apache Ant is used by IBM Sterling Control Center as part of dependency in ant-1.10.11.jar Vulnerability Details CVEID:CVE-2026-78254 DESCRIPTION: The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to...
Security Bulletin: Due to the use of HTTP/1.1 with Jetty server, IBM Sterling Control Center is vulnerable to Inconsistent Interpretation of HTTP Requests (CVE-2026-19203)
Summary HTTP/1.1 with Jetty server is used by IBM Sterling Control Center as part of dependency in jetty-http-12.0.25.jar. Vulnerability Details CVEID:CVE-2026-19203 DESCRIPTION: A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary...
Security Bulletin: Due to the use of HTTP/2 requests to a Jetty server, IBM Sterling Control Center is vulnerable to Uncontrolled Resource Consumption (CVE-2026-12611)
Summary HTTP/2 requests with Jetty server is used by IBM Sterling Control Center as part of dependency in jetty-http2-common-12.0.25.jar. Vulnerability Details CVEID:CVE-2026-12611 DESCRIPTION: A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never...
Security Bulletin: Due to the use of Jetty, IBM Sterling Control Center is vulnerable to Allocation of Resources Without Limits or Throttling (CVE-2026-19204)
Summary Jetty is used by IBM Sterling Control Center as part of dependency in jetty-websocket-core-common-12.0.25.jar. Vulnerability Details CVEID:CVE-2026-19204 DESCRIPTION: A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to...
Security Bulletin: Due to the use of Apache ActiveMQ, IBM Sterling Control Center is vulnerable to Improper Input Validation (CVE-2026-74761)
Summary Apache ActiveMQ is used by IBM Sterling Control Center as part of dependency in activemq-all-5.19.0.jar. Vulnerability Details CVEID:CVE-2026-74761 DESCRIPTION: Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. A...
Security Bulletin: Due to the use of jackson-databind, IBM Sterling Control Center is vulnerable to Uncontrolled Resource Consumption (CVE-2026-68497)
Summary Jackson-databind is used by IBM Sterling Control Center as part of dependency in jackson-databind-2.17.1.jar Vulnerability Details CVEID:CVE-2026-68497 DESCRIPTION: jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by...