112560 matches found
CVE-2026-97309
The RepairBuddy computer-repair-shop WordPress plugin, developed by Webful Creations , is vulnerable to a Missing Authorization flaw in versions up to and including 4.1226 . This vulnerability allows an attacker to Retrieve Embedded Sensitive Data from the application. While the technical root ca...
CVE-2026-97309 WordPress RepairBuddy plugin <= 4.1226 - Sensitive Data Exposure vulnerability
Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226...
CVE-2026-97309 WordPress RepairBuddy plugin <= 4.1226 - Sensitive Data Exposure vulnerability
Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226...
EUVD-2026-92584
Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63...
EUVD-2026-92581
Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.74...
EUVD-2026-92579
Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lookzy: from n/a through 1.1.14...
CVE-2026-105633 Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope
Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...
CVE-2026-105633 Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope
Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...
CVE-2026-105633 Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope
Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...
CVE-2026-105633
The open-source project management tool Plane is vulnerable to an authorization bypass in the V2 issue-attachment PATCH endpoint prior to version 1.4.0 . The root cause is that the server accepts an issue_id in the URL but fails to include it in the database query, matching only on pk, workspace,...
CVE-2025-1307
Exploit Newscrunch CVE-2025-1307 🚨 Visão Geral Este exploit visa uma vulnerabilidade crítica CVE-2025-1307 no tema Newscrunch do WordPress. A falha permite que usuários autenticados Assinante e acima façam upload de arquivos arbitrários devido à falta de verificações de permissões na função...
CVE-2026-104978
The open-source project management tool Plane is vulnerable to an invitation hijack prior to version 1.4.0 . The project invitation list endpoint lacks proper authorization, allowing any authenticated user who knows the workspace slug and project ID to access it. An attacker can enumerate pending...
CVE-2026-104978 Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance
Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible to any authenticated user who knows the workspace slug and project ID, while the public project invitation join endpoint accepts an invitation based only on a submitted email...
CVE-2026-104978 Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance
Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible to any authenticated user who knows the workspace slug and project ID, while the public project invitation join endpoint accepts an invitation based only on a submitted email...
CVE-2026-104978 Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance
Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible to any authenticated user who knows the workspace slug and project ID, while the public project invitation join endpoint accepts an invitation based only on a submitted email...
CVE-2026-46455
CVE-2026-46455 — camel-keycloak Verificação ISACTIVE Ausente Tokens Expirados Aceitos Reprodutores de prova-de-conceito executáveis para a mesma vulnerabilidade Apache Camel, um por runtime: Runtime| Diretório| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 +...
SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*
Summary GHSA-c8r8-95hg-mp34 added a centralized guard, util.IsForbiddenAbsPath, specifically to block access to a small set of sensitive files: conf/conf.json plaintext accessAuthCode/API token/cookie key, data/snippets/conf.json, the entire data/templates/ directory, and...
GHSA-3CM4-CCVW-6XR6 SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*
Summary GHSA-c8r8-95hg-mp34 added a centralized guard, util.IsForbiddenAbsPath, specifically to block access to a small set of sensitive files: conf/conf.json plaintext accessAuthCode/API token/cookie key, data/snippets/conf.json, the entire data/templates/ directory, and...