CVE-2026-104059 Lektor 3.3.14 CSRF via Admin API Endpoints

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...

CVE-2026-91109

The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'completegroup' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

EUVD-2026-90014

In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations...

CVE-2026-100286

Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request...

CVE-2026-100286

Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the Liquidsoap API endpoint due to missing internal connection requirements and improper validation of the AutoDJ flag. An attacker can inject arbitrary now-playing metadata, disrupt live broadcasts, and disclo...

CVE-2026-90923: Incorrect Authorization

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...

Astra Linux – Vulnerability in Intel Microcode

Observable timing discrepancies in some Intel processors may allow an authenticated user to potentially enable information disclosure through local access...

CVE-2026-17022

The Salon Booking System WordPress plugin through 10.30.33 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplyi...

CVE-2026-9203: Server-Side Request Forgery (SSRF)

A server-side request forgery vulnerability in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with low-privileged roles to bypass protections for cloud instance metadata endpoints. Successful exploitation can disclose cloud credentials and compromise cloud resourc...

PT-2026-67565

Name of the Vulnerable Software and Affected Versions Microsoft Edge Chromium-based affected versions not specified Description An origin validation error allows an unauthorized attacker to disclose information over a network. Origin validation is a security mechanism used to verify that a reques...

CVE-2026-44100 JupiCore charging point reconfiguration without auth

The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging point UIDs, Denial-of-Service and files tampering...

CVE-2026-17550: Out-of-bounds Read

A maliciously crafted DWG or DXF file, when parsed through Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash or disclose sensitive information...

ROS-20260720-73-0017

The vulnerability of the Accessibility component in Google Chrome browser relates to memory overflow outside the bounds of the program. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information through a specially created web page...

The vulnerability of the raw image format component in the console-based graphic editor ImageMagick allows a hacker to exploit it to disclose protected information.

The vulnerability of the raw image format component of the console-based graphic editor ImageMagick is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to disclose protected information...

CVE-2026-11851: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command "SQL Injection" in the web management interface of certain ASUS router models allows a remote authenticated user to disclose confidential information via a crafted request that bypasses existing input validation Refer to the ' ...

PT-2026-58140

Name of the Vulnerable Software and Affected Versions Microsoft Windows App Store affected versions not specified Description The use of an uninitialized resource allows an authorized attacker to locally disclose sensitive information, which can impact the system. Recommendations At the moment,...

CVE-2026-59180

A flaw was found in Apprise, an open-source library for sending notifications. HTTP-based notification plugins and HTTP attachment and configuration loaders in Apprise, prior to version 1.11.0, automatically follow HTTP redirects. During these redirects, user-configured authentication headers and...

ROS-20260623-73-0029

The vulnerability of the FileLoader class in the CPython interpreter relates to the disclosure of information in the error-prone data area. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information...

CVE-2026-45455

CVE-2026-45455 is an Excel information-disclosure vulnerability (out-of-bounds read) in Microsoft Office Excel. The issue allows an unauthorized attacker to disclose information over a network. Multiple connected documents confirm the affected component as Microsoft Excel (Office) and attribute t...