CVE-2026-61711

A flaw was found in BuildKit. A custom frontend could craft a build request with an invalid security mode, leading to the disabling of Seccomp and AppArmor protections for the build container. This bypasses the intended sandbox mechanisms, potentially allowing for broader impact within the...

be.personify.iam:personify-frontend (>=1.3.1.release, <=1.4.2.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=3.0.4, <=3.1.7) +176 more potentially affected by CVE-2026-76985 via org.apache.wicket:wicket-extensions (>=9.0.0, <=9.23.0)

org.apache.wicket:wicket-extensions MAVEN version =9.0.0, =1.3.1.release, =3.0.4, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.23.1 and more Source cves: CVE-2026-76985https://vulne...

WordPress Frontend Admin by DynamiApps plugin < 3.29.11 - Subscriber+ Arbitrary Membership Plan Deletion vulnerability

Subscriber+ Arbitrary Membership Plan Deletion vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Frontend Admin by DynamiApps versions 3.29.11...

PT-2026-84108

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.29.13 Description Insufficient file path validation in the move folders function allows unauthenticated attackers to delete arbitrary files on the server. This issue is exploitable when a form i...

CVE-2026-81346

The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans...

CVE-2026-10522

The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthenticated attackers to register a new user with an arbitrary role, including Administrator, leading to a full site takeover. Version 6.9 is...

CVE-2026-81346

The Frontend Admin by DynamiApps WordPress plugin, in versions prior to 3.29.11 , is vulnerable to a lack of capability checks on a specific AJAX action . This security flaw allows any authenticated user, such as a user with subscriber privileges, to perform unauthorized deletion of arbitrary mem...

EUVD-2026-68065

The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans...

CVE-2026-81346 Frontend Admin by DynamiApps < 3.29.11 - Subscriber+ Arbitrary Membership Plan Deletion

The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans...

CVE-2026-81346 Frontend Admin by DynamiApps < 3.29.11 - Subscriber+ Arbitrary Membership Plan Deletion

The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans...

CVE-2026-10522 Simple User Registration <= 6.9 - Unauthenticated Privilege Escalation to Administrator

The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthenticated attackers to register a new user with an arbitrary role, including Administrator, leading to a full site takeover. Version 6.9 is...

EUVD-2026-68040

The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthenticated attackers to register a new user with an arbitrary role, including Administrator, leading to a full site takeover. Version 6.9 is...

PT-2026-83417

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.29.11 Description The plugin fails to perform a capability check on an AJAX action. This allows any authenticated user, including those with subscriber-level privileges, to delete arbitrary...

CVE-2026-81346: Missing Authorization

The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans...

PT-2026-83392

Name of the Vulnerable Software and Affected Versions MemberHero WordPress plugin versions prior to 7.0 Description The plugin fails to restrict account fields during the frontend registration process. This allows unauthenticated attackers to register a new user with an arbitrary role, such as...

CVE-2026-54745

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenticated server-side request forgery vulnerability through the /proxy/ route in frontend/server/proxy-middleware.ts. The...

CVE-2026-82276 StarRocks Frontend REST Handlers Bypass the Base Class Authentication Gate

StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute directly instead of implementing executeWithoutPassword. Attackers can access six unauthenticated endpoints on the frontend HTTP port to disclose cluster topology, database...

CVE-2026-82276 StarRocks Frontend REST Handlers Bypass the Base Class Authentication Gate

StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute directly instead of implementing executeWithoutPassword. Attackers can access six unauthenticated endpoints on the frontend HTTP port to disclose cluster topology, database...

CVE-2026-82276

StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute directly instead of implementing executeWithoutPassword. Attackers can access six unauthenticated endpoints on the frontend HTTP port to disclose cluster topology, database...

CVE-2026-82276 StarRocks Frontend REST Handlers Bypass the Base Class Authentication Gate

StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute directly instead of implementing executeWithoutPassword. Attackers can access six unauthenticated endpoints on the frontend HTTP port to disclose cluster topology, database...