EUVD-2026-48439

A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/apiv2/serializers.py of the component API/Web. Such manipulation of the argument isstaff leads to improper privilege management. The attack may be performed from remote. The...

PT-2026-64255

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'category id' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-16767

A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Performing a manipulation of the argument entryName results in path traversal. It is possible to initiate the attack remotely. The...

CVE-2026-15719

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw...

CVE-2026-15718

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw...

CVE-2024-58353

creationtimestamp| type| source ---|---|--- 2026-07-23 22:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrduo7nkvw2j 2026-07-24 03:32:00+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mreg3ynzgo25...

CVE-2026-16764

A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/apiv2/serializers.py of the component API/Web. Such manipulation of the argument isstaff leads to improper privilege management. The attack may be performed from remote. The...

CVE-2026-16767

The CVE-2026-16767 entry concerns Ne-Lexa php-zip, affecting ZipFile::extractTo in src/ZipFile.php of the ZIP Handler up to version 4.0.2. The root cause is manipulation of the argument entryName, enabling path traversal. This can be exploited remotely and the exploit is public. The documents do ...

CVE-2026-16767

A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Performing a manipulation of the argument entryName results in path traversal. It is possible to initiate the attack remotely. The...

CVE-2026-16767 Ne-Lexa php-zip ZIP ZipFile.php extractTo path traversal

A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Performing a manipulation of the argument entryName results in path traversal. It is possible to initiate the attack remotely. The...

CVE-2026-16767 Ne-Lexa php-zip ZIP ZipFile.php extractTo path traversal

A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Performing a manipulation of the argument entryName results in path traversal. It is possible to initiate the attack remotely. The...

CVE-2026-16765

CodeAstro Online Classroom 1.0 contains a vulnerability in the file /OnlineClassroom/loginlinkadmin.php where manipulating the argument aid can trigger an SQL injection. The issue can be exploited remotely without authentication, and public exploit guidance exists. Affected component: loginlinkad...

CVE-2026-16765 CodeAstro Online Classroom loginlinkadmin.php sql injection

A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkadmin.php. Executing a manipulation of the argument aid can lead to sql injection. The attack can be executed remotely. The exploit has been...

CVE-2026-16765 CodeAstro Online Classroom loginlinkadmin.php sql injection

A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkadmin.php. Executing a manipulation of the argument aid can lead to sql injection. The attack can be executed remotely. The exploit has been...

CVE-2026-16764

A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/apiv2/serializers.py of the component API/Web. Such manipulation of the argument isstaff leads to improper privilege management. The attack may be performed from remote. The...

CVE-2026-16764

The CVE pertains to OWASP DefectDojo 2.59.0, where the UserSerializer in dojo/api_v2/serializers.py mishandles the is_staff argument, enabling improper privilege management. This issue can be exploited remotely; an exploit exists publicly. Remediation is to upgrade to DefectDojo 2.58.3 or 3.0.0, ...

CVE-2026-16764 OWASP DefectDojo API/Web serializers.py UserSerializer privileges management

A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/apiv2/serializers.py of the component API/Web. Such manipulation of the argument isstaff leads to improper privilege management. The attack may be performed from remote. The...

CVE-2026-16764 OWASP DefectDojo API/Web serializers.py UserSerializer privileges management

A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/apiv2/serializers.py of the component API/Web. Such manipulation of the argument isstaff leads to improper privilege management. The attack may be performed from remote. The...

CVE-2026-16764 OWASP DefectDojo API/Web serializers.py UserSerializer privileges management

A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/apiv2/serializers.py of the component API/Web. Such manipulation of the argument isstaff leads to improper privilege management. The attack may be performed from remote. The...

CVE-2026-16763 localstack serverless-localstack Configuration index.js os command injection

A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.composefile leads to os command injection. An atta...