CVE-2026-105267

A flaw was found in Gitea. The web endpoint used for deleting repository tags shares request handling logic with release deletion without verifying if the target is an ordinary tag. An authenticated collaborator with code write permissions can exploit this flaw to bypass release access controls a...

CVE-2026-62179 PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues

PraisonAI is a multi-agent teams system. In praisonai-platform prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependenc...

CVE-2026-62179 PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues

PraisonAI is a multi-agent teams system. In praisonai-platform prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependenc...

CVE-2026-62179 PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues

PraisonAI is a multi-agent teams system. In praisonai-platform prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependenc...

CVE-2026-62179

In praisonai-platform prior to version 0.1.9 , a vulnerability exists where workspace members can delete owner-created issue dependencies. The root cause is an incorrect authorization flaw where the system checks permissions against the caller-selected URL issue instead of verifying the owner's p...

GO-2026-6664 Grafana legacy correlations allow cross-tenant disclosure and deletion in github.com/grafana/grafana

Grafana legacy correlations allow cross-tenant disclosure and deletion in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

BIT-JOOMLA-2026-90915 Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Core - 20260905 - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -An improper validation of the cache group name allowed path traverals in the file storage of the caching layer, resulting in arbitrary directory deletions...

CVE-2026-102781

Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider 5.4.6 - modOsTouchSliderHelper::getAjax, wired through Joomla’s core comajax dispatcher, is the single handler behind every data-management operation this module exposes. No call to JFactory::getUser,...

CVE-2026-102781 Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6

Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider 5.4.6 - modOsTouchSliderHelper::getAjax, wired through Joomla’s core comajax dispatcher, is the single handler behind every data-management operation this module exposes. No call to JFactory::getUser,...

CVE-2026-102781

The OrdaSoft Touch Slider Joomla extension versions prior to 5.4.6 is vulnerable to unauthenticated destructive CRUD operations. The root cause is a lack of access control, authentication checks (missing JFactory::getUser()), and CSRF token verification within the modOsTouchSliderHelper::getAjax(...

CVE-2026-97188

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...

cve-2019-14206-poc

CVE-2019-14206 - حذف الملفات التعسفي لـ Adaptive Images لووردبريس 📋 الفهرس 1. حول الثغرة 2. المتطلبات الأساسية 3. التثبيت 4. طرق الاختبار اختبار سريع اختبار كامل باستخدام Docker اختبار باستخدام Nuclei اختبار يدوي 5. تفسير النتائج 6. التنظيف 7. استكشاف الأخطاء وإصلاحها 8. التخفيف 9. إخلاء مسؤولية...

CVE-2025-62950-PoC

الوصف يصف إثبات المفهوم هذا PoC ثغرة تزوير الطلبات عبر المواقع CSRF الموجودة في إضافة Contest Gallery – Upload, Vote & Sell with PayPal and Stripe v. 26.1.2. تسمح هذه المشكلة للمهاجم بخداع مستخدم مُصادَق لتنفيذ طلب مُصمَّم يحذف عنصر معرض دون موافقته وعن غير قصد، مما يؤدي إلى فقدان محتوى بشكل غير...

CVE-2026-97188

The String locator WordPress plugin, in versions before 2.6.8 , is vulnerable to an unauthenticated PHP Object Injection vulnerability. The root cause is the failure to restrict allowed classes during the deserialization of database row content saved via the plugin's database editor . This allows...

EUVD-2026-94190

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...

CVE-2026-97188 String Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...

CVE-2026-97188 String Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor

The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and...

CVE-2026-103681 Frontend Dashboard < 3.0.0 - Subscriber+ Profile and Post Field Deletion via fed_user_profile_delete

The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, allowing authenticated users with low privileges, such as subscribers, to delete the Frontend Dashboard WordPress plugin before 3.0.0's configured profile and post form fields...

WordPress Frontend Dashboard plugin < 3.0.0 - Subscriber+ Profile and Post Field Deletion vulnerability

Subscriber+ Profile and Post Field Deletion vulnerability discovered by Daniel Dhaniswara in WordPress Plugin Frontend Dashboard versions 3.0.0...

Seecret.it

📦 Seecret.it — Secure sharing via one-time link Seecret.it is an online service for sharing passwords, documents or sensitive information via encrypted one-time links. Your data remains invisible, secure, and self-destructs after viewing. Ideal for IT teams, businesses, freelancers, and anyone...