CVE-2026-27364 WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability

Subscriber Broken Access Control in Style Kits = 2.6.5 versions...

CVE-2026-5006

A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include...

CVE-2026-55468

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

process_overwriting

Process Overwriting Process Overwriting is a PE injection technique, closely related to Process Hollowing and Module Overloading. With its help, you can replace the main executable not a DLL of the target process. It works only for a newly created process - injection to existing processes is not...

CVE-2025-22828

CVE-2025-22828 📜 Beschreibung Apache CloudStack 4.16.0 und spätere Versionen weisen ein Problem mit einer fehlerhaften Zugriffskontrolle auf, das es Benutzern mit Kenntnis der Ressourcen-UUIDs ermöglicht, Kommentare Annotationen zu Ressourcen zu lesen oder hinzuzufügen, auf die sie nicht zugreife...

EUVD-2026-39432

3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation...

CVE-2025-39247

CVE-2025-39247 الهدف: HikCentral Professional HCMP، خادم VMS مركزي CVE: CVE-2025-39247 — ثغرة في التحكم بالوصول CVSS 3.1: 8.6 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N المتأثر: V2.3.1 – V2.6.2 و V3.0.0 المُعالَج: V2.6.3 / V3.0.1 / حزمة الإصلاح CVE-2025-39247 تاريخ الإفصاح: 2025-08-28 تاريخ التحليل:...

CVE-2026-55468 Wagtail: Improper restriction handling on Pages admin API

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

CVE-2026-55468

CVE-2026-55468 affects the internal Pages admin API in Wagtail , an open-source CMS built on Django. The API returns page fields declared in api_fields without sufficient access control , allowing any user with Wagtail admin access to retrieve restricted draft and live page content , including ba...

CVE-2026-61419

Dell ThinOS 10, versions prior to 260510.2518, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2022-1442

CVE-2022-1442 Plugin Metform per WordPress = 2.1.3 - Controllo degli accessi improprio che consente la divulgazione non autenticata di informazioni sensibili Descrizione Il plugin è vulnerabile alla divulgazione di informazioni sensibili a causa di un controllo degli accessi improprio nel file...

dockerized-android

Dockerized Android Dockerized Android is a container-based framework that allows to execute and Android Emulator inside Docker and control it through a browser. This project has been developed in order to provide a starting point for integrating mobile security components into Cyber Ranges but it...

CVE-2026-76816 Netty: MQTT Topic Name and Client ID Validation Bypass

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and...

CVE-2026-76816

Netty , an asynchronous event-driven network framework, contains a validation bypass in its MqttEncoder prior to versions 4.1.137.Final and 4.2.17.Final . The encoder fails to validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null by...

CVE-2025-69581

CVE-2025-69581 In Chamilo LMS 1.11.2 wurde ein Problem entdeckt. Der Endpunkt /personaldata des sozialen Netzwerks legt selbst nach dem Abmelden vollständige sensible Benutzerinformationen offen, da ein ordnungsgemäßer Cache-Control fehlt. Durch die Verwendung der Zurück-Schaltfläche des Browsers...

CVE-2025-65672

CVE-2025-65672 Insecure Direct Object Reference IDOR in classroomio 0.1.13 ermöglicht nicht autorisierten Zugriff auf Freigabe- und Einladungsfunktionen der Kurseinstellungen. Betroffenes Produkt: ClassroomIO Betroffene Version: 0.1.13 Entdeckt von: Rivek Raj Tamang RivuDon, Sikkim, Indien Detail...

CVE-2025-65670

CVE-2025-65670 Un Riferimento Diretto a Oggetto Insicuro IDOR in classroomio 0.1.13 permette agli studenti di accedere a endpoint sensibili di admin/docente manipolando gli ID dei corsi negli URL, causando la divulgazione non autorizzata di dati sensibili del corso, dell'admin e degli studenti. L...

CVE-2023-23752

Joomla! options...

EUVD-2026-65086

Dell ThinOS 10, versions prior to 260510.2518, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-61419

Dell ThinOS 10, versions prior to 260510.2518, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...