tutor-lms-methodmap-poc

Tutor LMS ≤ 4.0.5 — Unauthenticated PHP Function Execution via...

CVE-2026-82183 OAuth Single Sign On 6.25.0 - 7.0.0 - Unauthenticated Account Takeover via Unverified Steam OpenID Assertion

The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts...

CVE-2026-81583

The My Login WordPress plugin (versions 7.0-7.1.15 ) contains a vulnerability where it fails to enforce the network's registration settings during site signups on multisite installations . This flaw allows users with a subscriber account , and in some cases unauthenticated users , to create new s...

CVE-2026-81583 Theme My Login 7.0 - 7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation

The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them...

CVE-2026-81583 Theme My Login 7.0 - 7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation

The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them...

EUVD-2026-69857

The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them...

CVE-2026-84702 facefusion before 3.7.0 Path Traversal via Job Identifier

facefusion through 3.6.1 fails to normalize job identifiers in getjobfilename, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations...

PT-2026-84769

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...

PT-2026-84761

Name of the Vulnerable Software and Affected Versions BIG-IP affected versions not specified BIG-IQ affected versions not specified Description An authenticated user with any role can escalate privileges by creating administrative user accounts. This is achieved through an undisclosed request sen...

F5 Networks BIG-IP : BIG-IP and BIG-IQ Configuration utility vulnerability (K000162521)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.4 / 17.5.1.8 / 21.0.0.3 / 21.1.0.1. It is, therefore, affected by a vulnerability as referenced in the K000162521 advisory. BIG-IP has a vulnerability where an authenticated user of any role may be able to create...

CVE-2026-78597

Missing Authorization CWE-862 in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only low-privilege Security feature access could invoke an administrative operation tha...

GHSA-PCQQ-5962-HVCW

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:31+00:00| seen| https://t.me/hackingAttack/17172 2026-09-02 01:03:05+00:00| seen| https://t.me/hackingAttack/17172 2026-09-07 22:00:06+00:00| seen| https://t.me/hackingAttack/17172 2026-09-08 00:00:10+00:00| seen|...

CVE-2022-0848

creationtimestamp| type| source ---|---|--- 2026-09-01 20:01:52+00:00| seen| https://t.me/hackingAttack/45373 2026-09-02 01:02:06+00:00| seen| https://t.me/hackingAttack/45373 2026-09-06 06:00:04+00:00| published-proof-of-concept| https://t.me/hackingAttack/45373 2026-09-07 01:00:31+00:00|...

CVE-2026-78597 Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation

Missing Authorization CWE-862 in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only low-privilege Security feature access could invoke an administrative operation tha...

CVE-2026-78597 Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation

Missing Authorization CWE-862 in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only low-privilege Security feature access could invoke an administrative operation tha...

EUVD-2026-69574

Missing Authorization CWE-862 in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only low-privilege Security feature access could invoke an administrative operation tha...

CVE-2026-78597 Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation

Missing Authorization CWE-862 in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only low-privilege Security feature access could invoke an administrative operation tha...

CVE-2026-78597

Kibana 's Entity Store feature is affected by a Missing Authorization flaw (CWE-862) that allows an authenticated user with only low-privilege Security feature access to invoke an administrative operation, creating and persisting Elasticsearch API keys under the caller's identity while bypassing ...

NPM: pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project

NPM: pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project vulnerability discovered by ? in WordPress Npm pnpm versions = 12.0.0-alpha.0, 12.0.0-alpha.5...

Kibana 8.19.21, 9.4.6 Security Update (ESA-2026-155)

Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation Missing Authorization CWE-862 in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding...