CVE-2026-19478

CVE-2026-19478 GitLab GraphQL unauthenticated project deletion ★ CVE-2026-19478 GitLab GraphQL @glintroduced unauthenticated arbitrary-method-invocation PoC ★ https://github.com/user-attachments/assets/bb5d5f8a-a9bf-4148-854b-14c25c501d4b Overview CVE-2026-19478 is an unauthenticated...

WordPress TS Poll < 2.4.0 - SQL Injection

WordPress TS Poll plugin 2.4.0 contains a SQL injection caused by lack of sanitization and escaping of a parameter before using it in a SQL statement, letting attackers perform SQL injection attacks, exploit requires admin privileges. id: CVE-2024-8625 info: name: WordPress TS Poll 2.4.0 - SQL...

CVE-2026-78622

Okta Verify for Windows uninstaller is vulnerable to improper link resolution . The uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privileges. The delete operation follows the junction target, resulting in recursive ...

CVE-2026-76969 Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)

@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data...

CVE-2026-8279

The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'deleteitempermissionscheck' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers ...

CVE-2026-8279 Masteriyo LMS <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion

The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'deleteitempermissionscheck' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers ...

CVE-2026-8279

CVE-2026-8279 affects the Masteriyo LMS WordPress plugin in all versions up to and including 2.2.0 . The root cause is a missing capability check in the delete_item_permissions_check function within the CourseProgressItemsController, allowing unauthenticated attackers to delete arbitrary course p...

PT-2026-86762

The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'delete item permissions check' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attacke...

Linux Distros Unpatched Vulnerability : CVE-2026-86090

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users ca...

CVE-2026-15550 Ninja Forms - Save Progress <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook

The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulkactions' function. This makes it possible for authenticated attackers, with...

CVE-2026-15550

The Ninja Forms – Save Progress WordPress plugin (versions ≤ 3.0.30) is affected by a missing authorization flaw rooted in the absence of capability checks and nonce verification within the bulk_actions function. Authenticated users holding subscriber-level or higher permissions can leverage this...

WordPress Ninja Forms - Save Progress plugin <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook vulnerability

WordPress Ninja Forms - Save Progress plugin = 3.0.30 - Missing Authorization to Authenticated Subscriber+ Arbitrary Data Deletion via admin-ajax.php with admininit Hook vulnerability discovered by Hermione in WordPress Plugin Ninja Forms - Save Progress versions = 3.0.30...

CVE-2026-7028-SQLI

CodeAstro-Online-Job-Portal-SQLi-Delete-All Details Vendor: CodeAstro Product: Online Job Portal Project in PHP MySQL Version: 1.0 Vulnerability Type: SQL Injection CWE: CWE-89 Affected Endpoint: /admin/jobs-admins/delete-jobs.php Parameter: id GET Impact: Allows deletion of all job records in th...

CVE-2026-55640 Nextcloud MCP Server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )

Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloudmcpserver/vector/webhookreceiver.py has no authentication by default because WEBHOOKSECRET defaults to None and startup...

CVE-2026-55640

Nextcloud MCP Server prior to 0.117.2 contains an authentication bypass in the POST /webhooks/nextcloud endpoint. The WEBHOOK_SECRET defaults to None and startup validation does not enforce it, allowing unauthenticated requests to handle_nextcloud_webhook(). The payload["user"]["uid"] field is at...

CVE-2026-78378

Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlled input before it is incorporated into Redis SCAN MATCH patterns. The /api/health/ endpoint attempted to resolve the supplied name to a known group or market, but when resolutio...

Astra Linux – Vulnerability in WebKit2GTK

“Clear History and Website Data” did not successfully clear the browsing history. The issue was resolved through improved data deletion mechanisms. This issue has been fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, iOS 14.3, and iPadOS 14.3, as we...

Exploit for CVE-2026-0603

CVE-2026-0603 Hibernate ORM Injection / Second-Order SQL Injec...

CVE-2026-63040

Apache InLong versions 2.0.0 through before 2.4.0 are affected by a missing authorization check in the StreamSource component (specifically the forceDelete function). Any authenticated user can logically delete all stream sources , resulting in high integrity and availability impact (CVSS 3.1 sco...

EUVD-2026-63259

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vulnerability in the MongoDB node's Find, Delete, and Aggregate operations, which parse the Query parameter as JSON after expression resolution without sanitizing MongoDB operators. An attacker who can influence the resolved query...