25491 matches found
PT-2026-83157
Contributor SQL Injection in WPBulky = 1.2.2 versions...
PT-2026-83060
Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description No information is available regarding the nature of this issue. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...
UBUNTU-CVE-2026-81521
The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name...
CVE-2026-81817
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...
CVE-2026-81658
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...
CVE-2026-81817
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...
WordPress Post Duplicator plugin <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution vulnerability
Missing Authorization to Authenticated Contributor+ Post Duplication with Arbitrary Author Attribution vulnerability discovered by Abi Wiranata in WordPress Plugin Post Duplicator versions = 3.0.11...
CVE-2026-58060
A flaw was found in Bouncy Castle for Java. A remote attacker could exploit a vulnerability where the HSS public-key level count is unbounded. This allows for a huge memory allocation during the verification process, leading to a denial of service DoS condition. This issue affects Bouncy Castle f...
EUVD-2026-66996
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...
CVE-2026-81658
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...
sandbox-runtime v0.0.74
Anthropic Sandbox Runtime srt A lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container. srt uses native OS sandboxing primitives sandbox-exec on macOS, bubblewrap on Linux and proxy-based network filterin...
EUVD-2026-66954
Contributor SQL Injection in Suggestion Engine for WooCommerce = 2.0.11 versions...
CVE-2026-80587
creationtimestamp| type| source ---|---|--- 2026-08-27 08:50:09+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mu2hq3yuww2y 2026-08-27 09:02:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mu2ifescyz2o 2026-08-27 16:23:29+00:00| seen|...
EUVD-2026-66452
In the Linux kernel, the following vulnerability has been resolved: xfs: fix off-by-one in rtrefcount btree root level validation xfsrtrefcountbtcomputemaxlevels sets mp-mrtrefcmaxlevels = mindmaxlevels, rmaxlevels + 1; where the trailing "+ 1" already accounts for the inode-root level, so the...
SUSE CVE-2026-80537
In the Linux kernel, the following vulnerability has been resolved: xfs: fix off-by-one in rtrefcount btree root level validation xfsrtrefcountbtcomputemaxlevels sets mp-mrtrefcmaxlevels = mindmaxlevels, rmaxlevels + 1; where the trailing "+ 1" already accounts for the inode-root level, so the...
PT-2026-82430
The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product...
CVE-2026-81817: Authorization Bypass Through User-Controlled Key
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...
CVE-2026-32564: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
CVE-2026-78139: Authorization Bypass Through User-Controlled Key
The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product...