24054 matches found
CVE-2026-15614 IdP-initiated SAML sessions not reliably invalidated (replay)
Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...
kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
A flaw was found in the Linux kernel's xfrm IPSec framework subsystem. This vulnerability, a use-after-free, occurs when the system incorrectly manages memory related to security policies, specifically during the deletion of xfrmstate lists. An attacker with local access could exploit this flaw b...
PYSEC-2026-3509 PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion
Summary PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/[email protected]. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into /.praison/cache/templates/github//// without...
PYSEC-2026-3526 PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API
Summary A workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role chec...
EUVD-2026-48201
Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.3 versions...
CVE-2026-59555
CVE-2026-59555 affects WordPress: Participants Database plugin version
CVE-2026-59542
The vulnerability CVE-2026-59542 affects the WordPress Kali Forms plugin
EUVD-2026-48195
Subscriber Arbitrary File Deletion in Kali Forms = 2.4.18 versions...
EUVD-2026-48183
Subscriber Arbitrary Content Deletion in WP EasyPay = 4.5.0 versions...
CVE-2026-57808
The CVE-2026-57808 entry concerns the WordPress WP EasyPay plugin (
CVE-2026-57808 WordPress WP EasyPay plugin <= 4.5.0 - Arbitrary Content Deletion vulnerability
Subscriber Arbitrary Content Deletion in WP EasyPay = 4.5.0 versions...
EUVD-2026-48176
Unauthenticated Arbitrary File Deletion in Broadcast Live Video = 7.2.4 versions...
CVE-2026-57716
CVE-2026-57716 affects the WordPress plugin WordPress Broadcast Live Video (VideoWhisper Live Streaming Integration)
EUVD-2026-48171
Contributor Arbitrary File Deletion in Picture Gallery = 1.6.5 versions...
CVE-2026-57696
The CVE concerns the WordPress Picture Gallery plugin (WordPress plugin) with versions
UBUNTU-CVE-2026-59676
A Time-of-check Time-of-use TOCTOU Race Condition vulnerability in seunshare of selinux policycoreutils allows a user calling seunshare that is running in the unconfined SELinux domain to delete arbitrary root-owned files, This issue affects policycoreutils through 3.10...
PT-2026-63853
Subscriber Arbitrary File Deletion in Kali Forms = 2.4.18 versions...
PT-2026-64180
Name of the Vulnerable Software and Affected Versions cal.com main branch Description A repository takeover issue exists in the GitHub Actions workflows. The pr.yml workflow utilizes the pull request target trigger with default write permissions, which are passed to check-types.yml. This second...
GHSA-33Q9-F52J-GC75 n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook
Impact The DELETE /$restEndpoint/test-webhook/:id route is registered before the authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The impact is limited to disrupting in-progress te...