Lucene search
+L

7237 matches found

Nuclei
Nuclei
added 2026/08/25 6:03 a.m.87 views

Controlled Admin Access WordPress Plugin <= 1.4.0 - Improper Access Control & Privilege Escalation

An Improper Access Control vulnerability was discovered in the plugin. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php and /wp-admin/options.php, can lead to a complete compromise of the target resource. id: CVE-2021-24215...

10CVSS8.7AI score0.09733EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.119 views

Github Enterprise - Remote Code Execution

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the...

9.8CVSS8.5AI score0.71725EPSS
SaveExploits1References5
CVE
CVE
added 2026/08/24 8:33 p.m.9 views

CVE-2026-77634

CakePHP , a PHP rapid development framework, is affected by a CRLF header injection vulnerability in its mail transport layer. Custom mail headers added via Message::setHeaders() or Message::addHeaders() do not strip CRLF bytes, allowing an attacker to inject arbitrary headers when user-controlle...

8.2CVSS5.4AI score
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/24 8:30 p.m.17 views

CVE-2026-77635 CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...

9.2CVSS
SaveExploits0References7
CVE
CVE
added 2026/08/24 12:49 p.m.9 views

CVE-2026-78365

Roskus Prospero Flow CRM versions 4.0.0 through 5.3.1 are affected by an IDOR (Insecure Direct Object Reference) in the supplier API . A missing authorization check on the company_id field allows any authenticated user to send a PUT request to /api/supplier/{id} and set company_id in the body, en...

9.3CVSS5.2AI score
SaveExploits0References3
EUVD
EUVD
added 2026/08/24 12:49 p.m.6 views

EUVD-2026-64839

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/id setting companyid...

9.3CVSS5.3AI score
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/24 12:49 p.m.20 views

CVE-2026-78365 IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/id setting companyid...

9.3CVSS
SaveExploits0References3
NVD
NVD
added 2026/08/21 1:18 p.m.9 views

CVE-2026-77780

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

5.3CVSS0.00253EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/21 12:12 p.m.10 views

EUVD-2026-63935

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

5.3CVSS5.4AI score0.00253EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/21 11:29 a.m.27 views

CVE-2026-77759 IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records

Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/id, which is resolved without...

8.7CVSS0.0032EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/21 12:31 a.m.12 views

EUVD-2026-63628

Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network...

8.6CVSS5.2AI score0.00552EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/20 10:18 p.m.15 views

CVE-2026-69558

Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network...

8.6CVSS0.00552EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/20 9:47 p.m.34 views

CVE-2026-69558

Microsoft Partner Center has an authorization bypass caused by a user-controlled key, enabling an unauthenticated remote attacker to disclose confidential information (CVSS 8.6, HIGH). The flaw requires no privileges or user interaction. No patch version or in-the-wild exploitation details are pr...

8.6CVSS5.1AI score0.00552EPSS
SaveExploits0References1
OSV
OSV
added 2026/08/20 9:01 p.m.9 views

CVE-2026-71485 Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in...

9.1CVSS5.7AI score
SaveExploits0References6
EUVD
EUVD
added 2026/08/20 8:26 p.m.10 views

EUVD-2026-63587

NoSleep 1.5.1 exposes a privileged XPC Mach service and accepts raw dictionary messages containing attacker-controlled command and NSBundlePath values.This issue affects NoSleep: 1.5.1...

6.9CVSS5.2AI score0.00105EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/20 5:53 p.m.17 views

CVE-2026-63384 Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value.

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in eventtagging.c when evtagunmarshalheader uses evtagdecodeint to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INTMAX becom...

8.7CVSS5.5AI score
SaveExploits0References7
CVE
CVE
added 2026/08/20 4:33 p.m.69 views

CVE-2026-40345

deepmerge-ts

8.2CVSS5.2AI score0.00467EPSS
SaveExploits1References4
Cvelist
Cvelist
added 2026/08/20 4:33 p.m.39 views

CVE-2026-40345 deepmerge-ts: Stack exhaustion when merging recursive object graphs

deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively merging records. When two input values...

8.2CVSS0.00467EPSS
SaveExploits1References4
Microsoft CVE
Microsoft CVE
added 2026/08/20 2:00 p.m.11 views

Microsoft Partner Center Information Disclosure Vulnerability

Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network...

8.6CVSS5.3AI score0.00552EPSS
SaveExploits0
CVE
CVE
added 2026/08/20 1:58 p.m.17 views

CVE-2026-64971

ATutor's restore functionality allows reflected XSS: a crafted URL triggers arbitrary JavaScript execution in the victim's browser. Only version 2.2.4 is confirmed vulnerable, but the product is no longer actively supported and has no fix, so other versions may also be affected. CVSS 4.0 base sco...

4.8CVSS5.7AI score0.0036EPSS
SaveExploits0References2
Rows per page
Query Builder