18479 matches found
CVE-2026-13464 Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...
EUVD-2026-48456
Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network...
PT-2026-64202
Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network...
CVE-2026-28698 Exposure of Sensitive System Information to an Unauthorized Control Sphere in Panduit IntraVUE by Pronetiqs
Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could expose the underlying host/share filesystem...
CVE-2026-47743
The CVE-2026-47743 issue affects Shopper’s admin Livewire components prior to v2.8.0. The root causes are: (1) IDOR-like vulnerability where public Eloquent identifiers could be rewritten in the wire payload due to missing #[Locked], enabling targeting of arbitrary records; (2) leakage of plainte...
CVE-2026-16768 Gdk-pixbuf: out-of-bounds read in ico parser
A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palet...
CVE-2026-65760
Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system...
CVE-2026-65760
The CVE-2026-65760 entry concerns the Joomla Easy Store extension by joomshaper.com (versions 1.0.0–2.0.1). The vulnerability is described as improper access checks that allow logged-in users to retrieve order and customer information for any order, indicating a cross-customer confidentiality lea...
EUVD-2026-48249
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Stock Alert: from n/a through 3.0.6...
CVE-2026-65535
CVE-2026-65535 concerns the WordPress TinyMCE Templates plugin, specifically versions
EUVD-2026-48114
Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons = 3.0.5 versions...
CVE-2026-65505
CVE-2026-65505 concerns WordPress sites using the Ultimate Store Kit Elementor Addons plugin, affected versions
EUVD-2026-48109
Unauthenticated Sensitive Data Exposure in Complianz = 7.5.0 versions...
CVE-2026-65498
Technical details about CVE-2026-65498 are not publicly available in the provided documents; no affected components, root cause, or remediation are disclosed. Monitor for updates.
CVE-2026-65490
The CVE-2026-65490 entry concerns the WordPress plugin Create by Mediavine (versions <= 2.5.3), with unauthenticated sensitive data exposure identified. The connected records confirm the affected software (Create by Mediavine plugin) and the version bound (
EUVD-2026-48086
Unauthenticated Sensitive Data Exposure in Ninja Tables = 5.2.10 versions...
CVE-2026-65474
The CVE concerns WordPress Ninja Tables plugin
EUVD-2026-48223
Contributor Sensitive Data Exposure in Polylang = 3.8.5 versions...