EUVD-2026-78651

Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project...

Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)

Summary The task-position endpoint authorizes only the task side of the write: TaskPosition.CanUpdate delegates to Task.CanUpdate write access to the task's own project and the request body's projectviewid is never validated to belong to the task's project, nor is any access to that view required...

TwoMillion-Machine-Writeup

About Machine TwoMillion is an Easy difficulty Linux box that was released to celebrate reaching 2 million users on HackTheBox. The box features an old version of the HackTheBox platform that includes the old hackable invite code. After hacking the invite code an account can be created on the...

WordPress Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint vulnerability

Authenticated Custom+ Privilege Escalation to addchild REST endpoint vulnerability discovered by Wordfence PRISM in WordPress Plugin Academy LMS versions = 4.0.3...

CVE-2023-1454

CVE-2023-1454 jmreport/qurestSql escaneo masivo de PoC para inyección SQL no autorizada Jeecg-Boot es una plataforma de desarrollo rápido basada en Spring Boot y Jeecg-Boot-Plus. La versión más reciente, jeecg-boot 3.5.0, ha sido reportada con múltiples vulnerabilidades de inyección SQL. Uso de l...

CVE-2026-107803 ProcessMaker has SQL injection in the tasks endpoint through the order_by parameter

ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the GET /api/1.0/tasks endpoint in ProcessMaker is vulnerable to SQL injection through the orderby parameter because ProcessMaker\Traits\TaskControllerIndexMethods::applyColumnOrdering concatenates a...

CVE-2026-107803 ProcessMaker has SQL injection in the tasks endpoint through the order_by parameter

ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the GET /api/1.0/tasks endpoint in ProcessMaker is vulnerable to SQL injection through the orderby parameter because ProcessMaker\Traits\TaskControllerIndexMethods::applyColumnOrdering concatenates a...

CVE-2026-107803

The open-source workflow management software ProcessMaker is vulnerable to SQL injection in the GET /api/1.0/tasks endpoint prior to version 2026.14.3 . The root cause is located in ProcessMaker raits askcontrollerindexmethods::applycolumnordering(), where the application concatenates a user-cont...

CVE-2026-104079

Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users to create and publish Envira galleries without the required capabilities, because the endpoint only checks edit permissions on...

CVE-2026-104079 Envira Gallery Lite < 1.16.2 Missing Authorization via Gallery Conversion REST Endpoint

Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users to create and publish Envira galleries without the required capabilities, because the endpoint only checks edit permissions on...

EUVD-2026-95769

Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users to create and publish Envira galleries without the required capabilities, because the endpoint only checks edit permissions on...

CVE-2026-104079

The Envira Gallery Lite plugin (versions prior to 1.16.2 ) is vulnerable to a missing authorization flaw in its gallery conversion REST endpoint. This flaw allows lower-privileged authenticated users to create and publish galleries without proper capabilities because the endpoint only verifies ed...

BIT-GHOST-2026-103280 Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint

Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote visitor to obtain it...

CVE-2026-92990

The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is the same on every site rather than a per-site secret, allowing unauthenticated users to read newsletter sending logs, including recipient email addresses...

CVE-2026-107910

An improper authentication vulnerability in the isauthenticated function src/bolt/boltapi.c in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to execute graph queries without credentials through the Bolt endpoint. The function decides whether a password is required by issuing an...

CVE-2026-107910

An improper authentication vulnerability in the isauthenticated function src/bolt/boltapi.c in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to execute graph queries without credentials through the Bolt endpoint. The function decides whether a password is required by issuing an...

EUVD-2026-95502

The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is the same on every site rather than a per-site secret, allowing unauthenticated users to read newsletter sending logs, including recipient email addresses...

EUVD-2026-95487

An improper authentication vulnerability in the isauthenticated function src/bolt/boltapi.c in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to execute graph queries without credentials through the Bolt endpoint. The function decides whether a password is required by issuing an...

CVE-2026-107910 Authentication bypass in FalkorDB Bolt endpoint via fail-open AUTH probe error handling

An improper authentication vulnerability in the isauthenticated function src/bolt/boltapi.c in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to execute graph queries without credentials through the Bolt endpoint. The function decides whether a password is required by issuing an...

CVE-2026-107910

FalkorDB versions before 4.20.0 are vulnerable to an authentication bypass in the is_authenticated function (src/bolt/bolt_api.c ) of the Bolt endpoint. The root cause is fail-open error handling during an empty AUTH command sent to Redis; the system only mandates a password upon receiving a WRON...