56782 matches found
CVE-2026-5069
The Fluent Forms plugin for WordPress is vulnerable to incorrect authorization via the 'subscriptionid' parameter in versions up to, and including, 6.2.1. This is due to insufficient ownership authorization checks in the payment cancellation AJAX flow. This makes it possible for authenticated...
GHSA-MC85-72GR-VM9F
creationtimestamp| type| source ---|---|--- 2026-07-10 02:12:08+00:00| seen| https://gist.github.com/alon710/771904cdd1d35750b64c7a038f4ce112...
EUVD-2026-42765
A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Affected by this issue is some unknown functionality of the file pkg/channels/mqtt/mqtt.go of the component MQTT Channel Handler. This manipulation of the argument clientid causes incorrect authorization. The attack is possible to be...
CVE-2026-33655
creationtimestamp| type| source ---|---|--- 2026-07-10 00:30:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqavg3db3k24 2026-07-10 03:01:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqb5urs7ts2l...
CVE-2026-44342
creationtimestamp| type| source ---|---|--- 2026-07-10 00:01:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqatrxo3fx26...
PT-2026-57340
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A flaw in the EV charging station backend allows multiple connections using the same charging station ID. This could enable an attacker to deploy multiple...
CVE-2026-44918
OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization...
CVE-2026-55689
OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, OpenFGA's OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set, allowing a token minted for an unrelated...
CVE-2026-55604
DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global SessionStore accepts caller-supplied sessionid values without binding them to any authenticated principal or transport session. An attacker can enumerate active session I...
CVE-2026-44787
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the signup flow could allow newly registered users to set primarygroupid and gain whisper-group privileges without legitimate group membership on sites with whispersallowedgroups configured. This...
CVE-2026-44787
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the signup flow could allow newly registered users to set primarygroupid and gain whisper-group privileges without legitimate group membership on sites with whispersallowedgroups configured. This...
CVE-2026-44787
Discourse exposes a flaw in signup: before versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a new user could set primary_group_id and gain whisper-group privileges when whispers_allowed_groups is configured. This is fixed in 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5. The CVSS 3.1 base score ...
CVE-2026-44787 Discourse: Signup-time primary_group_id assignment grants whisperer access
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the signup flow could allow newly registered users to set primarygroupid and gain whisper-group privileges without legitimate group membership on sites with whispersallowedgroups configured. This...
CVE-2026-52777
creationtimestamp| type| source ---|---|--- 2026-07-09 21:48:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqame5dcxj25 2026-07-09 22:35:05+00:00| published-proof-of-concept| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-9369-69wj-7m2f...
CVE-2026-55604
DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global SessionStore accepts caller-supplied sessionid values without binding them to any authenticated principal or transport session. An attacker can enumerate active session I...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection via the deleteUserReaction process. An attacker can access and manipulate sensitive database information by injecting crafted SQL through the idreaction and id URL path parameters as an authenticated user. Remediation...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper handling of the id parameter in the Bazar widget handler. An attacker can execute arbitrary JavaScript in the victim's browser by crafting a malicious URL that injects attacker-controlled attributes...
GHSA-V4HW-Q98X-8JMM vulnerabilities
Vulnerabilities for packages: linux-azure, linux-gcp, linux-qemu-melange, linux-qemu...