62368 matches found
CVE-2026-84646
The Jenkins automation server is vulnerable in versions 2.579 and earlier (and LTS 2.568.2 and earlier ). An attacker with Overall/Read permission can exploit a flaw where user objects appear as nested field values in other deserialized XML objects. By submitting crafted XML , the attacker can cr...
CVE-2026-84646
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...
EUVD-2026-70112
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...
CVE-2026-84646
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...
CVE-2026-17563
The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through...
EUVD-2026-70035
The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through...
CVE-2026-17563 WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form
The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through...
CVE-2026-17563 WP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form
The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the form's configuration, immediately publish posts through...
CVE-2026-17563
User Frontend WordPress plugin (versions before 4.3.11 ) enforces its subscription-purchase requirement only when rendering a frontend form, not when processing the actual post submission. This allows unauthenticated users to create—and, depending on form configuration, immediately publish —posts...
CVE-2026-84807
Kimai kimai/kimai through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team;...
CVE-2026-84807 Kimai before 2.65.0 Authentication Bypass via Team Creation
Kimai kimai/kimai through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team;...
EUVD-2026-69919
Kimai kimai/kimai through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team;...
CVE-2026-84807 Kimai before 2.65.0 Authentication Bypass via Team Creation
Kimai kimai/kimai through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team;...
CVE-2026-82958
Eclipse Ditto versions [1.3.0, 3.9.6] are affected by a JSON injection flaw in the ImplicitThingCreationMessageMapper of the connectivity service. When building a CreateThing command, placeholder values resolved from inbound message headers (e.g., MQTT 5 user properties, AMQP 1.0 application prop...
tutor-lms-methodmap-poc
Tutor LMS ≤ 4.0.5 — Unauthenticated PHP Function Execution via...
CVE-2026-82183 OAuth Single Sign On 6.25.0 - 7.0.0 - Unauthenticated Account Takeover via Unverified Steam OpenID Assertion
The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts...
CVE-2026-81583
The My Login WordPress plugin (versions 7.0-7.1.15 ) contains a vulnerability where it fails to enforce the network's registration settings during site signups on multisite installations . This flaw allows users with a subscriber account , and in some cases unauthenticated users , to create new s...
CVE-2026-81583 Theme My Login 7.0 - 7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation
The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them...
EUVD-2026-69857
The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them...
CVE-2026-81583 Theme My Login 7.0 - 7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation
The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them...