400 matches found
CVE-2021-44228
Vulnerabilidades en Log4j Actualización 19.12.2021: Se siguen descubriendo nuevas vulnerabilidades y nuevas formas de explotarlas en Log4j. Hemos añadido tres diagramas de flujo mapas mentales al repositorio git que describen respectivamente versiones vulnerables de Log4j, cómo comprobar si se es...
Vtiger CRM v7.2.0 - Directory Listing
Vtiger CRM v7.2.0 contains a directory traversal vulnerability caused by improper access controls in /libraries and /layout directories, letting attackers display hidden files and list directories, exploit requires no authentication. id: CVE-2020-19363 info: name: Vtiger CRM v7.2.0 - Directory...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: dm raid: Fixing access issues beyond the end of the raid member array When the dm-raid table is loaded using raidctr, dm-raid allocates an array rs-devsrs-raiddisks for the raid device members. rs-raiddisks is determined by the...
CVE-2026-89686
A flaw was found in the Linux kernel's Network File System Daemon nfsd for NFSv4 layouts. A race condition allows a remote attacker to trigger a kernel panic, leading to a Denial of Service DoS. This occurs when the nfsd4alloclayoutstateid function accesses a file pointer without proper locking...
CVE-2026-86730
Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger...
Linux Distros Unpatched Vulnerability : CVE-2026-85485
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping. The Table form layout and the Bootstrap 2 and 3...
CVE-2026-85611
OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim...
CVE-2026-85615 Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts
Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId. Authenticated attackers can supply an arbitrary victim dashboardId with their own projectId ...
EUVD-2026-71030
OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim...
CVE-2026-85611
OpenPanel versions before 2.3.0 are affected by a cross-tenant Broken Object Level Authorization (BOLA) vulnerability in the report.getLayouts and report.resetLayout tRPC procedures. The root cause is that these procedures fail to scope dashboard queries to the caller's own project, allowing an a...
CVE-2026-85611 OpenPanel before 2.3.0 Cross-Tenant BOLA via report procedures
OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim...
WordPress Layouts for WPBakery plugin <= 1.1.3 - Missing Authorization to Unauthenticated Template Cache Manipulation vulnerability
Missing Authorization to Unauthenticated Template Cache Manipulation vulnerability discovered by murd0ck, Patricio Briones CyberDoomer in WordPress Plugin Layouts for WPBakery versions = 1.1.3...
CVE-2026-7726 Layouts for WPBakery <= 1.1.3 - Missing Authorization to Unauthenticated Template Cache Manipulation via 'handle_sync' AJAX Action
The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the LayoutsWPBRemote::templatesync callback registered via wpajaxnoprivhandlesync in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated...
CVE-2026-7726
The CVE describes an unauthenticated vulnerability in the WordPress plugin Layouts for WPBakery
CVE-2026-7726 Layouts for WPBakery <= 1.1.3 - Missing Authorization to Unauthenticated Template Cache Manipulation via 'handle_sync' AJAX Action
The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the LayoutsWPBRemote::templatesync callback registered via wpajaxnoprivhandlesync in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated...
EUVD-2026-53172
The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the LayoutsWPBRemote::templatesync callback registered via wpajaxnoprivhandlesync in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated...
MAL-2026-11161 Malicious code in @joyfill/layouts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2f0675d4a2717361ec79b2c5a5cbf0ff0367e8d9cbf991f2f300df6c6b819ec Analysis of @joyfill/[email protected] surfaced no a static rule matches and no traced code paths indicating exfiltration, install-time remot...
Malicious code in @joyfill/layouts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2f0675d4a2717361ec79b2c5a5cbf0ff0367e8d9cbf991f2f300df6c6b819ec Analysis of @joyfill/[email protected] surfaced no a static rule matches and no traced code paths indicating exfiltration, install-time remot...