401270 matches found
CVE-2026-114704
Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4...
CVE-2026-114704 WordPress Relevanssi plugin <= 4.28.4 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4...
EUVD-2026-109297
Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4...
CVE-2026-116016
yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter...
EUVD-2026-109274
yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter...
CVE-2026-116016
The yudao-cloud software (through version 2026.09 ) is vulnerable to an authorization bypass that allows authenticated users to evade row-level data scope restrictions. The root cause is that the DataPermissionRpcWebFilter component trusts the data-permission-enable header. By sending this header...
CVE-2026-116016 yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header
yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter...
CVE-2026-116016 yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header
yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter...
Security update for the Linux Kernel
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues: The following security issues were fixed: CVE-2026-31731: thermal: core: Address thermal zone removal races with resume bsc1264042. CVE-2026-46028: crypto: algifaead - snapshot IV for async AEAD requests bsc1267430...
SUSE-SU-2026:24386-1 Security update for the Linux Kernel
The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2026-31731: thermal: core: Address thermal zone removal races with resume bsc1264042. - CVE-2026-46028: crypto: algifaead - snapshot IV for async AEAD requests...
CVE-2026-115998
IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects,...
php2shell-stx-research-pub
PHP2Shell STX Research I have been testing the PHP memory saf...
CVE-2026-115998 IDOR: User reads and modifies findings from other people's projects
IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects,...
CVE-2026-115998
An Insecure Direct Object Reference (IDOR) vulnerability exists in Cervantes version v1.3-beta . This flaw allows an authenticated attacker to access sensitive data from projects they do not own, including proof-of-concept details , credentials , and client information . Furthermore, the attacker...
EUVD-2026-109262
IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects,...
CVE-2026-115998 IDOR: User reads and modifies findings from other people's projects
IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects,...
CVE-2026-94075
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1...
CVE-2026-114190
Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Retrieve Embedded Sensitive Data.This issue affects LiteSpeed Cache: from n/a through 7.9...