CVE-2026-77995 Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client 3.2.0 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins...

CVE-2026-77995

CVE-2026-77995 is an arbitrary account takeover vulnerability in the miniOrange OAuth Client Joomla extension, affecting versions prior to 3.2.0 . The flaw is caused by the manipulation of a cookie value , allowing an unauthenticated attacker to log in as any account on the site, including admini...

CVE-2026-77995 Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2

Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client 3.2.0, OAuth Single Sign-On – OIDC SSO 1.2.2, Login with Keycloak OAuth Single Sign-On SSO 1.2.2, Single Sign-On for Educational Institutes 1.2.2 - The manipulation of a cookie value allows actors to login a...

WordPress Tamara Checkout plugin <= 1.9.9.20 - Unauthenticated Order Status Manipulation vulnerability

Unauthenticated Order Status Manipulation vulnerability discovered by Ezekiel Victor in WordPress Plugin Tamara Checkout versions = 1.9.9.20...

WordPress Dokan plugin < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount vulnerability

Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount vulnerability discovered by Bhaveshkumar Parmar in WordPress Plugin Dokan versions 5.0.14...

ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass

A flaw was found in ASP.NET Core. An authorized attacker can exploit this authentication bypass vulnerability over a network by manipulating assumed-immutable data. This can allow the attacker to elevate their privileges within the system...

CVE-2026-78180

A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modificati...

CVE-2026-78186

A remote reachable assertion vulnerability exists in the HSS component of Open5GS up to version 2.8.0, specifically in the file src/hss/hss-cx-path.c. The flaw is triggered by manipulation of the User-Name argument, leading to an assertion failure that impacts availability . The attack requires l...

CVE-2026-78182

A SQL injection vulnerability in Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System (versions up to 300R004C00B300 ) is triggered via the order/sort argument of the PlanController.getImmediatePlans function at /xbreport/api/v1/plamange/plansImmediate. The attack is remote, ...

[SECURITY] [DLA 4751-1] designate security update

Debian LTS Advisory DLA-4751-1 [email protected] https://www.debian.org/lts/security/ Carlos Henrique Lima Melara August 23, 2026 https://wiki.debian.org/LTS Package : designate Version : 1:15.0.2-0+deb11u1 CVE ID : CVE-2026-71193 CVE-2026-71194 Debian Bug : 1144145 Two security...

CVE-2026-78178 jQWidgets jqx-all.js jqxBaseFramework.extend prototype pollution

A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/jqxBaseFramework.extend of the file jqwidgets/jqx-all.js. This manipulation causes improperly controlled modification of object prototype attributes. The attack can be initiated remotely. The report...

CVE-2026-78170

UTT HiPER 1200GW (up to version 2.5.3-170306) is affected by a remote buffer overflow in the strcpy function within /goform/formConfigFastDirectionW. An authenticated attacker (low privileges) can exploit this by manipulating the ssid argument, potentially achieving full compromise of confidentia...

CVE-2026-78160

A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User Notes Handler. The manipulation of the argument ID leads to authorization bypass. The attack can be initiated remotely. Upgrading...

EUVD-2026-64669

A vulnerability was identified in code-projects Barangay Resident Profiling Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /boarders.php of the component Boarder Management Module. Such manipulation of the argument ID leads to authorization bypass. T...

EUVD-2026-64677

A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User Notes Handler. The manipulation of the argument ID leads to authorization bypass. The attack can be initiated remotely. Upgrading...

CVE-2026-78160 Dolibarr ERP User Notes note.php authorization

A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User Notes Handler. The manipulation of the argument ID leads to authorization bypass. The attack can be initiated remotely. Upgrading...

PT-2026-79794

A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User Notes Handler. The manipulation of the argument ID leads to authorization bypass. The attack can be initiated remotely. Upgrading...

Wazuh Process Files Code Execution

The vulnerability of the processfilesfromworker function in the framework/wazuh/core/cluster/master.py file of the security monitoring and threat detection platform Wazuh is related to improper external manipulation of file names or paths. Exploiting this vulnerability could allow a remote attack...

GitPython IndexFile Methods File Rewrite

The vulnerabilities of the IndexFile.fromtree, IndexFile.reset, and IndexFile.mergetree methods in the GitPython library for interacting with git repositories involve the exploitation of arguments. Exploiting these vulnerabilities can allow an attacker to rewrite any files at will...

PT-2026-80858

Name of the Vulnerable Software and Affected Versions miniOrange OAuth Client versions prior to 3.2.0 Description An issue in the miniOrange OAuth Client extension for Joomla allows an attacker to log in as any account, including administrators, without requiring a valid account or prior...