CVE-2026-71557

A flaw was found in go-git, an extensible Git implementation library. Maliciously crafted reference names, which can contain directory-traversal sequences, are not properly sanitized. This vulnerability allows an attacker to write files outside of the intended reference storage directory,...

SUSE-SU-2026:4283-1 Security update for php-composer2

This update for php-composer2 fixes the following issues: - CVE-2026-45793: GitHub OAuth tokens failing regex validation can cause credential disclosure bsc1271504. - CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898. - CVE-2026-59946:...

CVE-2025-14484

The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys Pixabay, Unsplash, Pixels configured by site...

CVE-2026-18439 Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutorquizbuildersave AJAX action due to missing validation that nested questionid, answerid, deletedquestionids, and...

CVE-2026-4123 RW Elephant Rental Inventory <= 2.3.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'toggle_cache' AJAX Action

The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missing capability check on the togglecache function which is hooked to the wpajaxtogglecache AJAX action. The function also lacks nonce...

CVE-2025-14484

The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification in all versions up to and including 1.0.3 . The root cause is missing authorization checks , which allows unauthenticated attackers to modify arbitrary API keys for Pixabay , Unsplash , and Pixels . Attackers c...

CVE-2025-14484 Image Buzz <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary API Key Modification via 'pixabay_api' Parameter

The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys Pixabay, Unsplash, Pixels configured by site...

CVE-2025-14484 Image Buzz <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary API Key Modification via 'pixabay_api' Parameter

The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys Pixabay, Unsplash, Pixels configured by site...

EUVD-2025-210982

The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys Pixabay, Unsplash, Pixels configured by site...

EUVD-2026-84208

lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: php (UTSA-2023-002406)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002406 advisory. In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with...

PT-2026-97020

Name of the Vulnerable Software and Affected Versions Kaneo versions 2.3.12 through 2.12.1 Description Authenticated workspace members with viewer or member roles can delete and modify tasks beyond their assigned permissions. This occurs because the 'PATCH /api/task/bulk' endpoint verifies...

PT-2026-97071

Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 3.0.0 Description A remote authenticated attacker can access or modify unauthorized resources. This is caused by the use of wildcards in Role-Based Access Control RBAC permission definitions, which is a metho...

PT-2026-96646

Name of the Vulnerable Software and Affected Versions CMP – Coming Soon & Maintenance Plugin by NiteoThemes versions prior to 4.1.18 Description An issue exists where a missing capability check on the 'cmp ajax import settings' AJAX action allows authenticated attackers with Editor-level access o...

PT-2026-96662

Name of the Vulnerable Software and Affected Versions WP User Manager versions prior to 2.9.19 Description The plugin allows unauthorized modification of data because the Connect::complete function lacks a capability check. This function is registered on the admin init hook, which executes for an...

CVE-2026-79314: Improper Access Control

A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can modify the inbound proxy configurations of other users, including remark, port, protocol, settings, enabled state, expiry time and traffic quota, by submitting a request referencing the target resource...

CVE-2026-79314

A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can modify the inbound proxy configurations of other users, including remark, port, protocol, settings, enabled state, expiry time and traffic quota, by submitting a request referencing the target resource...

CVE-2026-63104: Missing Authorization

Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks...

CVE-2026-18345: Missing Authorization

The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete function in versions up to, and including, 2.9.18. The function is registered on the admininit hook which fires for every authenticated user that...

CVE-2025-14484: Missing Authorization

The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys Pixabay, Unsplash, Pixels configured by site...