88736 matches found
EUVD-2026-57811
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents...
Moderate: Red Hat Security Advisory: gnome-remote-desktop security update
An update for gnome-remote-desktop is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
Kibana 9.4.4 Security Update (ESA-2026-83)
Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality...
Kibana 8.19.20, and 9.4.5 Security Update (ESA-2026-95)
Missing Authorization in Kibana Leading to Unauthorized Execution of Endpoint Response Actions Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A...
Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-88)
Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges...
CVE-2026-59506
: Missing Authentication for Critical Function vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...
CVE-2026-59506 Priority – CWE-306: Missing Authentication for Critical Function
: Missing Authentication for Critical Function vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...
CVE-2026-59506
Technical details are provided only in the Initial Description (CWE-306, CVSS 3.1, CRITICAL) and no connected documents contain further technical specifics for CVE-2026-59506.
EUVD-2026-57773
CWE-306: Missing Authentication for Critical Function...
CVE-2026-59506 Priority – CWE-306: Missing Authentication for Critical Function
: Missing Authentication for Critical Function vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solutions: All versions without Priwall v3...
CVE-2026-59506
CWE-306: Missing Authentication for Critical Function...
CVE-2026-14332
The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an...
CVE-2026-14332
CVE-2026-14332 affects the Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin for sites running versions prior to 7.0.9. The root cause is a missing capability check and absence of nonce verification on a store-management action, allowing any authenticated user (e.g., a subscriber) to t...
CVE-2026-14332 Ecwid by Lightspeed Ecommerce Shopping Cart < 7.0.9 - Subscriber+ Store Disconnection via 'ec_disconnect' Action
The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an...
CVE-2026-18945
CVE-2026-18945 concerns the WP Helper Premium WordPress plugin (before 4.7.6). The root cause is missing verification of the order key when rendering the custom order confirmation page and handling related AJAX actions, which allows unauthenticated users to view other customers’ order details (in...
CVE-2026-18945 WP Helper Premium < 4.7.6 - Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation
The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...
CVE-2026-13328
The CVE-2026-13328 affects the Food Menu WordPress plugin (TLP Food Menu – Restaurant Menu & Online Ordering for WooCommerce) prior to 6.0.2. The reservation-status update action lacks any capability/ownership checks and is exposed to unauthenticated users, protected only by a publicly available ...
CVE-2026-13328 TLP Food Menu < 6.0.2 - Unauthenticated Reservation Status Modification
The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the...
