Lucene search
+L

22437 matches found

EUVD
EUVD
added yesterday3 views

EUVD-2026-50983

The Easy Appointments WordPress plugin through 3.12.26 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...

3.8CVSS5.9AI score0.00148EPSS
SaveExploits0References1
Cvelist
Cvelist
added yesterday21 views

CVE-2026-14222 Easy Appointments <= 3.12.26 - Contributor+ Connection Deletion via Missing Authorization

The Easy Appointments WordPress plugin through 3.12.26 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...

0.00148EPSS
SaveExploits0References1
RedHat Linux
RedHat Linux
added yesterday5 views

kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

A flaw was found in the Linux kernel's xfrm IPSec framework subsystem. This vulnerability, a use-after-free, occurs when the system incorrectly manages memory related to security policies, specifically during the deletion of xfrmstate lists. An attacker with local access could exploit this flaw b...

7.8CVSS6.5AI score0.0013EPSS
SaveExploits1References5
RedhatCVE
RedhatCVE
added yesterday4 views

CVE-2026-64392

A flaw was found in the ksmbd component of the Linux kernel. This vulnerability allows an attacker to bypass filesystem permission checks during 'delete-on-close' operations. Specifically, when a file handle is torn down, the base-file unlink and extended attribute xattr removal operations...

9.1CVSS6AI score0.00469EPSS
SaveExploits0References4
CVE
CVE
added 2 days ago29 views

CVE-2026-64560

CVE-2026-64560 documents a Linux kernel issue in posix-cpu-timers that can cause a Use-After-Free when a timer is deleted during a non-leader exec() race. The vulnerability arises as sys_timer_delete() may observe an old leader while a leader change occurs, leading to a freed posix timer object b...

7.8CVSS5.7AI score0.00112EPSS
SaveExploits0References8
OSV
OSV
added 2 days ago3 views

CVE-2026-64560 posix-cpu-timers: Prevent UAF caused by non-leader exec() race

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec race Wongi and Jungwoo decoded and reported a non-leader exec related race which can result in an UAF: systimerdelete exec posixcputimerdel // Observes old leader p =...

7.8CVSS5.7AI score0.00112EPSS
SaveExploits0References11
NVD
NVD
added 2 days ago5 views

CVE-2026-65889

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion 2.20.2 - The generateNewApp method allows actors to recursively delete directories...

9.2CVSS0.00323EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2 days ago3 views

CVE-2026-65889 Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion 2.20.2 - The generateNewApp method allows actors to recursively delete directories...

9.2CVSS5.8AI score0.00323EPSS
SaveExploits0References2
CVE
CVE
added 2 days ago10 views

CVE-2026-65889

Joomla extension Gridbox (balbooa.com) for

9.2CVSS5.8AI score0.00323EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2 days ago24 views

CVE-2026-65889 Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion 2.20.2 - The generateNewApp method allows actors to recursively delete directories...

9.2CVSS0.00323EPSS
SaveExploits0References2
EUVD
EUVD
added 2 days ago5 views

EUVD-2026-50334

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion 2.20.2 - The generateNewApp method allows actors to recursively delete directories...

9.2CVSS5.8AI score0.00323EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
added 2 days ago5 views

kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

A flaw was found in the Linux kernel's xfrm IPSec framework subsystem. This vulnerability, a use-after-free, occurs when the system incorrectly manages memory related to security policies, specifically during the deletion of xfrmstate lists. An attacker with local access could exploit this flaw b...

7.8CVSS5.8AI score0.0013EPSS
SaveExploits1References5
NVD
NVD
added 2 days ago5 views

CVE-2026-14488

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the templateredirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handlerequest function routing the mbfsdelete action without any capability or...

9.1CVSS0.00307EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2 days ago26 views

CVE-2026-14488 Meta Box AIO <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'rwmb_frontend_field_object_id' Parameter

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the templateredirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handlerequest function routing the mbfsdelete action without any capability or...

9.1CVSS0.00307EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2 days ago5 views

CVE-2026-14488

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the templateredirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handlerequest function routing the mbfsdelete action without any capability or...

9.1CVSS5.9AI score0.00307EPSS
SaveExploits0References3
CVE
CVE
added 2 days ago16 views

CVE-2026-14488

CVE-2026-14488 affects the Meta Box AIO WordPress plugin (MB Frontend Submission extension) up to version 3.8.0. The vulnerability stems from handle_request() routing the mbfs_delete action without capability/ownership checks, and nonce verification in check_ajax() being gated behind is_ajax(), w...

9.1CVSS5.9AI score0.00307EPSS
SaveExploits0References2
EUVD
EUVD
added 2 days ago5 views

EUVD-2026-50274

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the templateredirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handlerequest function routing the mbfsdelete action without any capability or...

9.1CVSS5.9AI score0.00307EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2 days ago27 views

CVE-2026-5060 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the stmlmsdeletecover function lacking ownership validation on the fileid parameter before...

6.5CVSS0.0022EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2 days ago5 views

CVE-2026-5060

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the stmlmsdeletecover function lacking ownership validation on the fileid parameter before...

6.5CVSS5.9AI score0.0022EPSS
SaveExploits0References5
EUVD
EUVD
added 2 days ago5 views

EUVD-2026-50271

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the stmlmsdeletecover function lacking ownership validation on the fileid parameter before...

6.5CVSS5.9AI score0.0022EPSS
SaveExploits0References4
Rows per page
Query Builder