1253789 matches found
EUVD-2026-67003
A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Conte...
CVE-2026-81668 Rubygem-katello: cross-tenant content view filter rule access and modification via unauthorized parent filter lookup
A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Conte...
CVE-2026-81668 Rubygem-katello: cross-tenant content view filter rule access and modification via unauthorized parent filter lookup
A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Conte...
CVE-2026-81668
Katello (also tracked as rubygem-katello ) contains an authorization flaw in the Content View Filter Rules API . The API does not properly enforce authorization on the parent Content View Filter , allowing an authenticated, low-privileged user with Content View permissions in one organization to ...
CVE-2026-73427
A flaw was found in Trix, a rich text editor. A remote attacker could exploit this vulnerability by convincing a victim to drag and drop a specially crafted JSON payload into an editor using the Level0InputController. This could bypass sanitization and allow the injection of executable JavaScript...
CVE-2026-81668
A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Conte...
WordPress RSS Aggregator by Feedzy plugin < 5.2.6 - Author+ Cross-User Import Job Manipulation and Post Deletion vulnerability
Author+ Cross-User Import Job Manipulation and Post Deletion vulnerability discovered by Farid Narimanov in WordPress Plugin Feedzy versions 5.2.6...
vulnerabilities present in Microsoft Office
Microsoft has identified vulnerabilities in various Office products. A malicious individual can exploit these vulnerabilities to carry out attacks that can cause damage as described in the following table. For successful exploitation, the malicious individual must deceive the victim into opening ...
CVE-2026-81658 Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...
CVE-2026-81658
Foreman is affected by an authorization flaw in its template revision endpoint , which does not enforce object-level authorization when retrieving audited template revisions. An authenticated, low-privileged user with a template-related permission (e.g., view_ptables) can retrieve historical temp...
CVE-2026-81658 Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...
CVE-2026-81658
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...
CVE-2026-81273
Unauthenticated Cross Site Request Forgery CSRF in FluentBooking Pro = 2.2.4 versions...
CVE-2026-78293
Unauthenticated Cross Site Scripting XSS in WP w3all phpBB = 3.0.6 versions...
CVE-2026-81271
Unauthenticated Cross Site Request Forgery CSRF in GeoDirectory = 2.8.176 versions...
CVE-2026-78289
Unauthenticated Cross Site Scripting XSS in CozyStay = 1.10.0 versions...
CVE-2026-78273
Subscriber Cross Site Scripting XSS in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78281
Unauthenticated Cross Site Scripting XSS in CP Media Player = 1.3.0 versions...