7723 matches found
CVE-2026-81335 Baserow before 2.3.1 Unauthenticated Data Disclosure via Discarded Permission Check on Builder Data Sources
Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/datasources/views.py are declared with a permission class that admits any caller, so a request carrying no...
CVE-2026-81335
Baserow before 2.3.1 is vulnerable to unauthenticated data disclosure via its Application Builder data sources. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/data_sources/views.py use a permission class that admits any caller, and DataSourceService.dispatch_data_so...
CVE-2026-81335 Baserow before 2.3.1 Unauthenticated Data Disclosure via Discarded Permission Check on Builder Data Sources
Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/datasources/views.py are declared with a permission class that admits any caller, so a request carrying no...
CVE-2026-79676
A flaw was found in NLTK. This path traversal vulnerability allows attackers to bypass security measures by using symbolic links within trusted data roots. By staging specially crafted symlinked corpus files, an attacker can disclose sensitive information from outside the intended data directorie...
CVE-2026-71084
A flaw was found in mysql-connector-odbc. An unauthenticated attacker with local logon access to the infrastructure where MySQL Connectors executes can exploit this vulnerability. This can lead to a complete denial of service DoS by causing the component to crash repeatedly. Additionally, the...
WordPress MultiVendorX plugin < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint vulnerability
Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint vulnerability discovered by ryan fabella in WordPress Plugin MultiVendorX versions 5.0.11...
WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by TruongLV1 From FPT Night Wolf in WordPress Plugin Mobile App for WooCommerce versions = 0.4.62...
CVE-2026-16568 ShopApper <= 0.4.62 - Subscriber+ Customer Data Disclosure via IDOR
The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user e.g. a customer/subscriber to...
CVE-2026-16568
This is an IDOR (Insecure Direct Object Reference) vulnerability in The Mobile App for WooCommerce: ShopApper WordPress plugin. A REST endpoint fails to verify that the requesting user owns the customer profile being queried, allowing any authenticated Subscriber+ user to retrieve other users' pe...
CVE-2026-78986
A flaw was found in Chromium. A remote attacker, after compromising the renderer process, could exploit an uninitialized resource in the Graphics Processing Unit GPU by crafting a malicious HTML page. This could potentially lead to the disclosure of sensitive cross-origin data...
CVE-2026-78941
A flaw was found in Google Chrome. A remote attacker, after compromising the renderer process, could exploit an information leak by using a specially crafted HTML page. This vulnerability allows the attacker to bypass site isolation, potentially leading to the disclosure of sensitive information...
CVE-2026-79196
A flaw was found in Google Chrome's Editing feature. This race condition vulnerability allows a remote attacker, leveraging social engineering, to obtain sensitive information by crafting a malicious HTML page. Successful exploitation could lead to unauthorized disclosure of user data...
CVE-2026-79086
A flaw was found in CustomTabs in Google Chrome on Android. This missing authorization vulnerability allows a local attacker, through a co-installed application, to obtain sensitive information. This could lead to the unauthorized disclosure of user data...
WordPress Stripe Payment Forms by WP Full Pay plugin < 8.5.1 - Unauthenticated Customer Portal Subscription and Billing Data Disclosure vulnerability
Unauthenticated Customer Portal Subscription and Billing Data Disclosure vulnerability discovered by Vaibhav Narkhede in WordPress Plugin WP Full Stripe Free versions 8.5.1...
CVE-2026-80194
Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route reportprojectviewexport. The authorization guards are attached to the sibling invoke method rather than at the class level, so the export route inherits no authorization checks. Any...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql5 (UTSA-2026-093307)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093307 advisory. Vulnerability in the MySQL Client product of Oracle MySQL component: C API. Supported versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.18 an...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql5 (UTSA-2026-093276)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093276 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Encryption. Supported versions that are affected are 5.6.45 and prior and 5.7....
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql5 (UTSA-2026-093635)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093635 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Information Schema. Supported versions that are affected are 5.7.32 and prior and 8.0.22 and...
CVE-2026-80194 Kimai before 2.64.0 Missing Authorization via ProjectViewController export
Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route reportprojectviewexport. The authorization guards are attached to the sibling invoke method rather than at the class level, so the export route inherits no authorization checks. Any...