384 matches found
CVE-2026-69127
Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby...
CVE-2026-10524 CoCart < 4.9.0 - Unauthenticated Arbitrary Price Manipulation
The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at...
CLSA-2026-1782867589 TuxCare security update for symfony/routing (2 CVEs)
TuxCare rebuilt symfony/routing to address 2 CVEs. Fixed in v7.4.9-p1+tuxcare...
OPENSUSE-SU-2026:11446-1 cockpit-repos-4.9-1.1 on GA media
These are all security issues fixed in the cockpit-repos-4.9-1.1 package on the GA media of openSUSE Tumbleweed...
DEBIAN-CVE-2026-64493
In the Linux kernel, the following vulnerability has been resolved: iio: pressure: mpl115: fix runtime PM leak on read error mpl115readraw takes a runtime PM reference with pmruntimegetsync before reading the processed pressure or raw temperature, but on the read error path it returns without...
CVE-2026-65473
CVE-2026-65473 affects the WordPress Virtue/Ascend/Pinnacle Toolkit plugin (versions
Oracle Linux 10 : mysql8.4 (ELSA-2026-20693)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-20693 advisory. 8.4.9-1 - Rebase to 8.4.9 8.4.8-2 - Revert to soft static allocation of MariaDB and MySQL sysusers.d files Tenable has extracted the preceding...
PT-2026-63895
Contributor Cross Site Scripting XSS in Virtue/Ascend/Pinnacle Toolkit = 4.9.12 versions...
EUVD-2026-45050
Kirby is an open-source content management system. Versions prior to 4.9.1 and 5.4.1 do not check the pages.access permission during page draft rendering. Permissions are defined for each user role in the user blueprint site/blueprints/users/.... It is also possible to customize the permissions f...
EUVD-2026-45047
Kirby is an open-source content management system. Prior to 4.9.1 and 5.4.1, Kirby did not validate the model attributes that were used in its collection queries, allowing attackers to include arbitrary model methods in their queries. This includes methods with sensitive data such as password...
CVE-2026-55771 CedarJava has policy injection, type confusion, and incorrect equality comparison vulnerabilities
CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 4.9.0, the EntityIdentifier.equals has inverted null/self branches which could lead to incorrect equality comparisons. The EntityIdentifier.equals meth...
CVE-2026-55771
CVE-2026-55771 affects CedarJava prior to 4.9.0, where EntityIdentifier.equals() has inverted null/self-reference checks, causing incorrect equality results in custom integrations. The bug does not alter Cedar’s authorization decisions (computed in Rust from JSON) but could affect external code p...
PT-2026-57856
Name of the Vulnerable Software and Affected Versions CedarJava versions prior to 4.9.0 Description The EntityIdentifier.equals function contains inverted logic for null and self-reference checks. This causes the method to return true for null comparisons and false for self-comparisons, leading t...
BIT-NEXTCLOUD-2023-49790 App PIN code can be bypassed in Nextcloud Files iOS
The Nextcloud iOS Files app allows users of iOS to interact with Nextcloud, a self-hosted productivity platform. Prior to version 4.9.2, the application can be used without providing the 4 digit PIN code. Nextcloud iOS Files app should be upgraded to 4.9.2 to receive the patch. No known workaroun...
Cube-TempRoot
Cube LD800 temporary root shell This tool is specific to the...
CVE-2026-49276 Kirby: Self cross-site scripting (self-XSS) in the writer field
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the writer field in any blueprint allowed a scripting link to be included as the target of a link or email link in writer mark components, making the target clickable by the user who entered it and...
CVE-2026-49276 Kirby: Self cross-site scripting (self-XSS) in the writer field
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the writer field in any blueprint allowed a scripting link to be included as the target of a link or email link in writer mark components, making the target clickable by the user who entered it and...
CVE-2026-54002 Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins that use the writer or list fields or call Dom::sanitize, Sane::sanitize, Sane::Html::sanitize, Sane::Svg::sanitize, Sane::Xml::sanitize, Sane::sanitizeFile, or file sanitizeContents with untruste...
EUVD-2026-40937
The Slim SEO – A Fast & Automated SEO Plugin For WordPress plugin for WordPress is vulnerable to Unauthorized Private Content Disclosure in all versions up to, and including, 4.9.8 via the /wp-json/slim-seo/meta-tags/ai REST API endpoint. This is due to the endpoint's permissioncallback performin...
