154869 matches found
CVE-2026-12690 ProfileGrid < 5.9.9.7 - Subscriber+ Premium License Tampering via Missing Authorization
The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license setting...
CVE-2026-12690
The CVE covers the ProfileGrid WordPress plugin (versions before 5.9.9.7). The root cause is missing a proper capability check for license-management actions, relying solely on a nonce exposed to any logged-in user. This enables authenticated users with Subscriber-level access and above to overwr...
SUSE CVE-2026-63863
In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: Fix unbalanced unlock in drmgpusvmscanmm There is a unbalanced lock/unlock to gpusvm notifier lock: 931.045868 ===================================== 931.046509 WARNING: bad unlock balance detected! 931.047149...
CVE-2026-35425
Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network...
EUVD-2026-48438
Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET...
CVE-2026-35425 Azure API Management (APIM) Remote Code Execution Vulnerability
...
EUVD-2026-48455
Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network...
CVE-2026-35425
CVE-2026-35425 concerns Azure API Management (APIM) with an “Improper access control” condition that enables a network-exposed remote code execution by an authorized attacker. Affected software is APIM; the root cause is access-control weaknesses that allow code execution over the network. The pr...
CVE-2026-35425
Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network...
CVE-2026-35425 Azure API Management (APIM) Remote Code Execution Vulnerability
...
PT-2026-64419
Name of the Vulnerable Software and Affected Versions Tycon Systems TPDIN-Monitor-WEB2 affected versions not specified Description The web management interface stores and displays system credentials in cleartext on a configuration page accessible to authenticated users. Individuals with access to...
PT-2026-64360
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the fb find mode function within the fbdev modedb component. When the mode option is NULL, it is assigned the value of mode option buf. The mode option b...
PT-2026-64296
Name of the Vulnerable Software and Affected Versions Loytec LIP-ME201C versions prior to 8.4.17 Loytec L-INX versions prior to 8.4.17 Loytec L-GATE versions prior to 8.4.17 Loytec L-ROC versions prior to 8.4.17 Loytec L-IOB versions prior to 8.4.17 Loytec L-DALI versions prior to 8.4.17 Loytec...
Apache Syncope permissions and access control vulnerabilities (CNVD-2026-30665)
Apache Syncope is an open-source digital identity management system, primarily used for authentication, authorization, and account management. There are security vulnerabilities in Apache Syncope. These vulnerabilities stem from insufficient protection of the Groovy security sandbox, which leads ...
PT-2026-64372
Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read pending prompt queues ...
Google Chrome Resource Management Error Vulnerability (CNVD-2026-30668)
Google Chrome is a web browser developed by Google, primarily offering fast and secure web browsing features. Google Chrome has a resource management vulnerability, which stems from improper handling of object lifecycles in the Blink component. Attackers can exploit this vulnerability to execute...
VulnCheck KEV: CVE-2025-4283
A vulnerability was found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /classes/Login.php?f=login. The manipulation of the argument Username leads to sql injection. The attack may be initiated remotely...
PT-2026-64201
Name of the Vulnerable Software and Affected Versions Azure API Management affected versions not specified Description Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network. Recommendations At the moment, there is no information about a...
Apache Syncope permissions and access control vulnerabilities (CNVD-2026-30660)
Apache Syncope is an open-source identity management platform, primarily used for user authentication, authorization, and account management in enterprise environments. There are security vulnerabilities in Apache Syncope. These vulnerabilities stem from a bypass of the Groovy security sandbox...
CVE-2026-65694
Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET...