25426 matches found
CVE-2026-81817
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...
WordPress Post Duplicator plugin <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution vulnerability
Missing Authorization to Authenticated Contributor+ Post Duplication with Arbitrary Author Attribution vulnerability discovered by Abi Wiranata in WordPress Plugin Post Duplicator versions = 3.0.11...
CVE-2026-58060
A flaw was found in Bouncy Castle for Java. A remote attacker could exploit a vulnerability where the HSS public-key level count is unbounded. This allows for a huge memory allocation during the verification process, leading to a denial of service DoS condition. This issue affects Bouncy Castle f...
EUVD-2026-66996
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...
CVE-2026-81658
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...
sandbox-runtime v0.0.74
Anthropic Sandbox Runtime srt A lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container. srt uses native OS sandboxing primitives sandbox-exec on macOS, bubblewrap on Linux and proxy-based network filterin...
EUVD-2026-66954
Contributor SQL Injection in Suggestion Engine for WooCommerce = 2.0.11 versions...
CVE-2026-80587
creationtimestamp| type| source ---|---|--- 2026-08-27 08:50:09+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mu2hq3yuww2y 2026-08-27 09:02:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mu2ifescyz2o 2026-08-27 16:23:29+00:00| seen|...
EUVD-2026-66452
In the Linux kernel, the following vulnerability has been resolved: xfs: fix off-by-one in rtrefcount btree root level validation xfsrtrefcountbtcomputemaxlevels sets mp-mrtrefcmaxlevels = mindmaxlevels, rmaxlevels + 1; where the trailing "+ 1" already accounts for the inode-root level, so the...
SUSE CVE-2026-80537
In the Linux kernel, the following vulnerability has been resolved: xfs: fix off-by-one in rtrefcount btree root level validation xfsrtrefcountbtcomputemaxlevels sets mp-mrtrefcmaxlevels = mindmaxlevels, rmaxlevels + 1; where the trailing "+ 1" already accounts for the inode-root level, so the...
PT-2026-82430
The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product...
CVE-2026-81274: Missing Authorization
Subscriber Broken Access Control in Ditty = 3.1.67 versions...
CVE-2026-78285: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in Like Button Rating = 2.6.61 versions...
CVE-2026-78139: Authorization Bypass Through User-Controlled Key
The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product...
CVE-2026-81817: Authorization Bypass Through User-Controlled Key
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...
CVE-2026-77018: Unrestricted Upload of File with Dangerous Type
The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...
CVE-2026-32564: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
CVE-2026-77017: Exposure of Sensitive Information to an Unauthorized Actor
The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its...
PT-2026-82624
Name of the Vulnerable Software and Affected Versions Flowintel versions 3.3.0 and earlier Description An insecure direct object reference and broken object-level authorization issue exists across multiple task endpoints. The system failed to verify if a task belonged to the provided case...