EUVD-2026-90501

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-92245

The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including names, email addresses, pho...

EUVD-2026-90464

The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including names, email addresses, pho...

PT-2026-104059

Name of the Vulnerable Software and Affected Versions ClipBucket versions 5 through 5.5.3-197 Description Authenticated users with ad manager access permission can perform SQL injection via the delete parameter in the 'admin area/ads manager.php' endpoint. By using time-based blind payloads...

PT-2026-104019

Name of the Vulnerable Software and Affected Versions PictShare versions prior to 3.7.1 Description An information disclosure issue exists where unauthenticated attackers can obtain the secret delete code and uploader metadata. This occurs when calling the 'API::info' endpoint, which returns the...

CVE-2026-102106 Kiteworks Email Protection Gateway improper authentication

Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid...

CVE-2026-10739

Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe...

CVE-2026-102578

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

UBUNTU-CVE-2026-102578

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

CVE-2026-102578

A SQL injection vulnerability exists in the Moodle learning management system. An authenticated attacker who has access to the question bank web service can submit unsanitized input that is directly processed into database queries. This flaw allows the attacker to view, alter, or delete sensitive...

EUVD-2026-89717

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

CVE-2026-97150

The BcAddonMigrator plugin in baserCMS (provided by baserCMS Users Community) is vulnerable to an Inclusion of Functionality from Untrusted Control Sphere (CWE-829). During the conversion of baserCMS4-style addons to baserCMS5-style ones, the BcAddonMigrator incorrectly includes the config.php fi...

CVE-2026-102578

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

CVE-2026-91072

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on...

CentOS Linux 8.5 [TuxCare] Security Update: mysql / mysql-common / mysql-devel / mysql-errmsg / mysql-libs / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1768587465)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1768587465 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are...

CVE-2026-42048

CVE-2026-42048 CVE-2026-42048 Langflow 路径遍历 / 任意目录删除 PoC https://github.com/user-attachments/assets/6e5481ff-e953-47a5-8870-70b30c6550de 描述 CVE-2026-42048：Langflow 任意目录删除漏洞 描述：Langflow 1.9.0 之前的版本存在一个路径遍历漏洞，允许已认证的攻击者通过批量删除端点 DELETE /api/v1/knowledgebases 删除预期知识库存储路径之外的目录。该问题的成因是：用户可控的 kbnames...

CVE-2024-21111

CVE-2024-21111 Oracle VirtualBox 7.0.16 より前のバージョンは、シンボリックリンクの追従によるローカル権限昇格の脆弱性の影響を受け、任意のファイル削除および任意のファイル移動につながります。 VirtualBox は、C:\ProgramData\VirtualBox（すべてのユーザーが書き込み可能）内のログファイルを NT AUTHORITY\SYSTEM として移動し、序数（連番）でバックアップしようとしますが、最大 10 件のログまでです。また VirtualBox は、11 件目のログを NT AUTHORITY\SYSTEM...

CVE-2026-100287

Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently delete or restore vault attachments via a crafted API request...

CVE-2026-100287

Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently delete or restore vault attachments via a crafted API request...

CVE-2026-100287

The Devolutions Server (version 2026.3.5.0 and earlier) is vulnerable to a missing authorization flaw in the attachment history API . This vulnerability allows an authenticated low-privileged user to perform unauthorized actions, specifically the ability to permanently delete or restore vault att...