61357 matches found
PT-2026-93267
Name of the Vulnerable Software and Affected Versions JetFormBuilder versions prior to 3.6.3 Description An issue exists where the plugin fails to validate if a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post content as form schema and executing an Advanced...
CVE-2026-87031: Missing Authorization
n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint POST /ccm/api/1.0/users, the add method of concrete/src/Api/Controller/Users.php did not perform a permission check before creating an account. As a result, any valid OAuth token carrying the users:add scope, including a...
CVE-2026-92802: Missing Authorization
kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking board:create permission. Attackers can bypass authorization checks by using the importProjects mutation to create boards while remaining...
CVE-2026-12793: Improper Privilege Management
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content ...
CVE-2026-86071: Improper Limitation of a Pathname to a Restricted Directory
Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtractor.java can create directories outside the intended extraction root when processing a crafted archive entry. LocalFolderExtractor.createFile validat...
PT-2026-93293
The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploadin...
CVE-2024-11222: Time-of-check Time-of-use (TOCTOU) Race Condition
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed a developer user to perform actions in the context of another user's merge request commit due to a race...
PT-2026-93318
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 13.0 through 19.1.7 GitLab CE/EE versions 19.2 through 19.2.5 GitLab CE/EE versions 19.3 through 19.3.1 Description A race condition during pipeline creation may allow a developer user to perform actions within the contex...
AZL-103086 CVE-2025-11395 affecting package podman 5.6.1-10
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...
AZL-103137 CVE-2025-11395 affecting package containerized-data-importer 1.62.0-8
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...
AZL-103068 CVE-2025-11395 affecting package buildah 1.43.1-3
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...
AZL-103224 CVE-2025-11395 affecting package libcontainers-common 20240213-3
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...
DEBIAN-CVE-2025-11395
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...
AZL-103079 CVE-2025-11395 affecting package cri-o 1.30.1-1
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...
CVE-2025-11395
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...
CVE-2025-11395
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...
UBUNTU-CVE-2025-11395
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...
CVE-2025-11395
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...
CVE-2025-11395
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...
AZL-103230 CVE-2026-79705 affecting package libcontainers-common 20240213-3
A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not...