115700 matches found
EUVD-2026-78648
Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited...
CVE-2026-107854
The Jexactyl game management and billing system (versions 4.0.0 to 4.0.5 ) contains an authorization bypass vulnerability in the POST /api/client/billing/free/process endpoint. The application fails to verify ownership when processing a client-controlled server_id , allowing an authenticated user...
CVE-2026-107854 Jexactyl: Free-billing order endpoint renews and unsuspends arbitrary servers by ID (missing ownership check)
Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled serverid and loads the server without restricting the lookup to servers owned by the authenticated account. On installations...
CVE-2026-107854 Jexactyl: Free-billing order endpoint renews and unsuspends arbitrary servers by ID (missing ownership check)
Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled serverid and loads the server without restricting the lookup to servers owned by the authenticated account. On installations...
CVE-2026-106271
A missing authorization flaw was found in the Workers component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553118313...
WordPress AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure vulnerability
Missing Authorization to Authenticated Subscriber+ Sensitive Information Disclosure vulnerability discovered by Wordfence PRISM in WordPress Plugin AutomatorWP versions = 5.8.4...
CVE-2026-106387
A missing authorization flaw was found in the Mobile component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/518096516...
CVE-2026-106367
A missing authorization flaw was found in the Mobile component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/520533412...
CVE-2026-106289
A missing authorization flaw was found in the FedCM component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/517700327...
CVE-2026-106205
A missing authorization flaw was found in the Passwords component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/519499907...
CVE-2026-106183
A missing authorization flaw was found in the Chromoting component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553154579...
WordPress WP File Download plugin <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary File Deletion/Modification vulnerability discovered by t4g0 in WordPress Plugin WP File Download versions = 6.3.9...
CVE-2026-106425
A missing authorization flaw was found in the BrowserTag component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/501790682...
CVE-2026-106406
A missing authorization flaw was found in the Mobile component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/505186109...
CVE-2026-106365
A missing authorization flaw was found in the Animation component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/498075038...
CVE-2026-106363
A missing authorization flaw was found in the FullScreen component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/501896592...
CVE-2026-106267
A missing authorization flaw was found in the Network component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/498737756...
CVE-2026-106224
A missing authorization flaw was found in the Google Lens component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/502278429...