25125 matches found
EUVD-2026-72910
An XXE XML External Entity vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload...
PT-2026-86952
SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command...
PT-2026-87165
Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description A security issue in the aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks. This occurs when Atlas Search feature...
CVE-2026-79572: Improper Restriction of XML External Entity Reference
An XXE XML External Entity vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload...
CVE-2026-76931: Improper Neutralization of Input During Web Page Generation
The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...
CVE-2026-17509: Improper Neutralization of Special Elements used in an SQL Command
The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes ...
CVE-2026-2520: Missing Authorization
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, wit...
CVE-2026-16502: Deserialization of Untrusted Data
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...
Siemens Siveillance Control
SUMMARY A vulnerability has been identified in the Open Interface Services OIS web module affecting Siveillance Control and Siveillance Control Pro versions OIS 3.x.y and OIS 4.x.y . This vulnerability allows an attacker to upload arbitrary files, which can lead to unauthorized root-level access...
CVE-2026-79572
An XXE XML External Entity vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload...
EEF-CVE-2026-81638 Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry
Summary Improper Handling of Alternate Encoding vulnerability in ash-project ashdoubleentry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3...
CVE-2026-81638 Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry
Improper Handling of Alternate Encoding vulnerability in ash-project ashdoubleentry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so...
radare2 v6.2.2
Radare2: Libre Reversing Framework for Unix Geeks Current git master branch is 6.2.4, next release will be 6.2.5. Description r2 is a complete rewrite of radare. It provides a set of libraries, tools and plugins to ease reverse engineering tasks. Distributed under LGPLv3, despite each plugin can...
CVE-2026-86426
creationtimestamp| type| source ---|---|--- 2026-09-07 14:07:46+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3muwombeul522 2026-09-08 18:08:31+00:00| seen| https://bsky.app/profile/vulnsea.com/post/3muzmjo32o42g 2026-09-09 15:00:07+00:00| confirmed|...
CVE-2017-6458
creationtimestamp| type| source ---|---|--- 2026-09-07 13:15:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3muwlohukka2v...
CVE-2026-12853 Flamingo <= 2.6.2 - Authenticated (Contributor+) Missing Authorization to Unauthorized Tag Information Disclosure via wp.getTerms and ajax-tag-search
The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...
BIT-ELK-2026-72633 Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring
Incorrect Authorization CWE-863 in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurri...
CVE-2026-86504: Inclusion of Functionality from Untrusted Control Sphere
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution...
Linux Distros Unpatched Vulnerability : CVE-2026-53769
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks...