CVE-2025-59342

CVE-2025-59342 - Path Traversal esm-dev Author: Byte Reaper Description CVE-2025-59342 is a path traversal vulnerability in esm.sh, a nobuild content delivery network CDN for modern web development, in version 136 and earlier. The issue exists in the handling of the X-Zone-Id HTTP header, which i...

CVE-2026-118801

The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.18.0 via the 'id' parameter. This makes it possible for authenticated attackers, wit...

CVE-2026-118801

The aBlocks plugin for WordPress (versions up to and including 2.18.0 ) is vulnerable to Sensitive Information Exposure via the id parameter in the ablocks_template shortcode. This flaw allows authenticated attackers with contributor-level access to extract the full rendered body content of any p...

EUVD-2026-118972

The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.18.0 via the 'id' parameter. This makes it possible for authenticated attackers, wit...

CVE-2026-118801 aBlocks <= 2.18.0 - Authenticated (Contributor+) Sensitive Information Exposure in 'ablocks_template' Shortcode

The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.18.0 via the 'id' parameter. This makes it possible for authenticated attackers, wit...

nCentralDumpsterDiver

SolarWinds n-Central Dumpster Diver Description / Explanation FIXES/WORKAROUNDS have been released for more information: https://vulners.com/cve/CVE-2020-7984 This application utilizes the nCentral agent dot net libraries to simulate the agent registration and pull the agent/appliance configurati...

CVE-2026-120512

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wdformelement Hidden Input field, name = user-defined, e.g. hiddenprobe' parameter in all versions up to, and including, 1.15.50 due to insufficien...

EUVD-2026-118548

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wdformelement Hidden Input field, name = user-defined, e.g. hiddenprobe' parameter in all versions up to, and including, 1.15.50 due to insufficien...

Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcard

A vulnerability in Ivanti Endpoint Manager EPM allows an unauthenticated attacker to coerce the EPM machine account credential via the GetHashForWildcard endpoint. The vulnerability exists due to improper input validation in the wildcard parameter, allowing an attacker to specify a remote UNC pat...

PT-2026-139445

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field 00' parameter in all versions up to, and including, 1.12.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-124027

ChatWiki before 2.10.0 contains a missing authentication vulnerability in the GET /manage/getLibRawFileOnePage route that allows unauthenticated attackers to read other tenants' documents. Attackers can enumerate sequential adminuserid and file id query parameters, bypassing the ownership check, ...

CVE-2026-124025

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability in TicketController::ticketprint and the pdfThread endpoint that fails to verify ticket department or assignment. Authenticated agents can request arbitrary ticket ids via GET /ticket/print/id to render PDFs of other...

CVE-2026-124026

Bar Assistant 6.0.0-rc1 before 6.11.0 contains an incorrect authorization vulnerability in CocktailController::copy that allows registered users to bypass source cocktail membership checks. Attackers owning a bar can POST to /api/cocktails/id/copy with other bars' cocktail ids to copy private...

CVE-2026-124026 Bar Assistant 6.0.0-rc1 before 6.11.0 Incorrect Authorization via Cocktail Copy

Bar Assistant 6.0.0-rc1 before 6.11.0 contains an incorrect authorization vulnerability in CocktailController::copy that allows registered users to bypass source cocktail membership checks. Attackers owning a bar can POST to /api/cocktails/id/copy with other bars' cocktail ids to copy private...

CVE-2026-124027

ChatWiki versions before 2.10.0 are affected by a missing authentication vulnerability in the GET /manage/getLibRawFileOnePage route. This flaw allows unauthenticated attackers to bypass ownership checks by enumerating sequential admin_user_id and file id query parameters. Successful exploitation...

EUVD-2026-118434

Bar Assistant 6.0.0-rc1 before 6.11.0 contains an incorrect authorization vulnerability in CocktailController::copy that allows registered users to bypass source cocktail membership checks. Attackers owning a bar can POST to /api/cocktails/id/copy with other bars' cocktail ids to copy private...

CVE-2026-124026

The Bar Assistant software (versions 6.0.0-rc1 before 6.11.0 ) is vulnerable to an incorrect authorization flaw in the CocktailController::copy function. This vulnerability allows registered users to bypass source cocktail membership checks. Specifically, an attacker who owns a bar can perform a ...

EUVD-2026-118435

ChatWiki before 2.10.0 contains a missing authentication vulnerability in the GET /manage/getLibRawFileOnePage route that allows unauthenticated attackers to read other tenants' documents. Attackers can enumerate sequential adminuserid and file id query parameters, bypassing the ownership check, ...

CVE-2026-124026 Bar Assistant 6.0.0-rc1 before 6.11.0 Incorrect Authorization via Cocktail Copy

Bar Assistant 6.0.0-rc1 before 6.11.0 contains an incorrect authorization vulnerability in CocktailController::copy that allows registered users to bypass source cocktail membership checks. Attackers owning a bar can POST to /api/cocktails/id/copy with other bars' cocktail ids to copy private...

CVE-2026-124026 Bar Assistant 6.0.0-rc1 before 6.11.0 Incorrect Authorization via Cocktail Copy

Bar Assistant 6.0.0-rc1 before 6.11.0 contains an incorrect authorization vulnerability in CocktailController::copy that allows registered users to bypass source cocktail membership checks. Attackers owning a bar can POST to /api/cocktails/id/copy with other bars' cocktail ids to copy private...