7929 matches found
CVE-2026-68570
Apache Doris is affected by an Incorrect Authorization vulnerability that allows an authenticated user to bypass privilege checks and read data they are not authorized to access, resulting in unauthorized information disclosure . Affected versions span 2.0.0 through 2.1.* , 3.0.0 through 3.0.* , ...
EUVD-2026-77355
Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read, resulting in unauthorized disclosure of information. This issue affects Apache Doris: from 2.0.0 through 2.1., from 3.0.0 through 3.0., fr...
EUVD-2026-77344
Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies. The patch shows that CLI access could differ from the web application in multiple security-sensitive areas: - feed listings did...
CVE-2026-85188
Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager Free, Pro 12.1.0, Conditional Content Free, Pro 8.0.0, Content Templater Pro 14.2.0, ReReplacer Pro 16.2.0 for Joomla - The Conditions editor creates a default Condition Set name from the item to which the se...
CVE-2026-85188 Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager (Free, Pro) < 12.1.0, Conditional Content (Free, Pro) < 8.0.0, Content Templater (Pro) < 14.2.0, ReReplacer (Pro) < 16.2.0 for Joomla
Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager Free, Pro 12.1.0, Conditional Content Free, Pro 8.0.0, Content Templater Pro 14.2.0, ReReplacer Pro 16.2.0 for Joomla - The Conditions editor creates a default Condition Set name from the item to which the se...
EUVD-2026-77307
Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager Free, Pro 12.1.0, Conditional Content Free, Pro 8.0.0, Content Templater Pro 14.2.0, ReReplacer Pro 16.2.0 for Joomla - The Conditions editor creates a default Condition Set name from the item to which the se...
CVE-2026-85188
CVE-2026-85188 affects several Regular Labs Joomla extensions : Advanced Module Manager (< 12.1.0), Conditional Content (< 8.0.0), Content Templater (< 14.2.0), and ReReplacer (
About the security content of Safari 27
About the security content of Safari 27 This document describes the security content of Safari 27. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...
CVE-2026-86407 User Registration & Membership < 5.2.8 - Unauthenticated User Data Disclosure via Membership Thank You Page
The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's ema...
CVE-2026-86407
The User Registration & Membership WordPress plugin before 5.2.8 fails to verify that a visitor requesting its membership confirmation (thank you) page actually owns the account named in the request or that any registration/purchase occurred. This allows unauthenticated users to retrieve another ...
EUVD-2026-76951
The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX actions, allowing unauthenticated users to read the submitted entries of any form created with a supported third-party form Conta...
EUVD-2026-76191
Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4...
WordPress Teddy Bear Customize Addon plugin <= 1.0.5 - Unauthenticated Order Data Disclosure vulnerability
Unauthenticated Order Data Disclosure vulnerability discovered by 0xBassia in WordPress Plugin Teddy Bear Customize Addon versions = 1.0.5...
CVE-2026-14562
The teddy-bear-customize-addon WordPress plugin (versions through 1.0.5 ) fails to perform authorization or ownership checks before returning WooCommerce order metadata and customer-uploaded attachment URLs . This allows unauthenticated attackers to disclose other customers' order and attachment ...
com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records
A flaw was found in jackson-databind. When Java Records use a PropertyNamingStrategy, an attacker can bypass the @JsonIgnore annotation during deserialization. This allows a renamed JSON key to be assigned to a Record constructor parameter, even if it was intended to be ignored. Consequently, an...
CVE-2026-9225
IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/flowid endpoint, the application allows...
CVE-2026-9225
IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/flowid endpoint, the application allows...
CVE-2026-9225 Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation
IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/flowid endpoint, the application allows...
CVE-2026-88036
The GridFS component of the MongoDB C Driver is vulnerable to query-operator injection in file identifiers. A caller-supplied structured file ID can be interpreted as a query condition rather than a literal identifier, allowing an authenticated user who can influence the identifier to either read...
GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ Driver
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifi...