24677 matches found
CVE-2026-77144
The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event managemen...
CVE-2026-77145
The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event management access could therefore modify events belonging to other organizers...
CVE-2026-77129
The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this field to disclose sensitive data or execute TypoScript conte...
EUVD-2026-65346
The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this field to disclose sensitive data or execute TypoScript conte...
EUVD-2026-65332
The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event managemen...
CVE-2026-77144
CVE-2026-77144 is a broken access control vulnerability in the TYPO3 extension Events 2 (events2), specifically in its frontend management plugin. The plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own, while th...
CVE-2026-77144 Broken Access Control in extension "Events 2" (events2)
The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event managemen...
EUVD-2026-65331
The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event management access could therefore modify events belonging to other organizers...
TYPO3-EXT-SA-2026-023: Server-Side Template Injection in extension "Event management and registration" (sf_event_mgt)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-023...
TYPO3-EXT-SA-2026-023: Broken Access Control in extension "Event management and registration" (sf_event_mgt)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-023...
CVE-2026-10627
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.4.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
EUVD-2026-65170
Unauthenticated Cross Site Scripting XSS in Event Tickets = 5.29.2.1 versions...
12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event Log
Description The plugin does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high privilege users such as admin. The PoC...
12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event Log
Description The plugin does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high privilege users such as admin. PoC The...
CVE-2026-78263
Unauthenticated Cross Site Scripting XSS in Event Tickets = 5.29.2.1 versions...
CVE-2026-78263 WordPress Event Tickets plugin <= 5.29.2.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Event Tickets = 5.29.2.1 versions...
CVE-2026-78263
Event Tickets WordPress plugin versions
CVE-2026-76816
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and...
UBUNTU-CVE-2026-76816
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and...
CVE-2026-74637
A flaw was found in the Linux kernel's perf subsystem. A local attacker could exploit a use-after-free vulnerability when a perf event group's sibling is detached but remains active, and its pointer to the group leader is not properly updated. This improper handling can lead to a system crash,...