37455 matches found
BIT-KIBANA-2026-72681 Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure
Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. This allows privilege escalation and could lead to disclosure of sensitive information th...
WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Kalles Addons versions = 1.0.6...
CVE-2026-58372
A flaw was found in SeaweedFS. An authenticated remote attacker with write access to a single bucket could exploit a path traversal vulnerability in the S3 gateway. By crafting a DeleteObjects XML request body with specific object keys containing directory traversal sequences, the attacker could...
PT-2026-78340
Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...
PT-2026-78346
Name of the Vulnerable Software and Affected Versions Kalles Addons versions prior to 1.0.7 Description An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when untrusted input is passed to the unserialize function, allowing an attacker to manipulate serialized objec...
PT-2026-78417
Name of the Vulnerable Software and Affected Versions stigmem-node versions prior to 0.9.0a12 Description A broken object level authorization BOLA flaw exists in the right-to-be-forgotten RTBF tombstone mechanism. The issue tombstone function defaulted the tenant to "default" instead of the...
PT-2026-78418
Name of the Vulnerable Software and Affected Versions stigmem-node versions prior to 0.9.0a12 Description Broken object level authorization BOLA exists in the quarantine review endpoints. In multi-tenant deployments using the stigmem-plugin-multi-tenant plugin, the get quarantined fact function i...
PT-2026-78419
Name of the Vulnerable Software and Affected Versions stigmem versions prior to 0.9.0a12 Description An issue exists in the decay sweep endpoint where broken object level authorization allows authenticated attackers with write credentials for a single tenant to perform decay operations across all...
PT-2026-78450
Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference multiple frontend/API actions in J-BusinessDirectory 6.2.3...
CVE-2026-55106
authentik's LDAP Source API diagnostic action bypasses object-level read-authorization, letting unauthenticated clients trigger upstream LDAP queries using the source's bind credentials. The response exposes DNs and attribute names (not values), revealing directory structure, naming conventions, ...
CVE-2026-55106 authentik: Unauthenticated LDAP directory data disclosure
authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the...
CVE-2026-75485
A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather...
CVE-2026-74012
Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue affects TaxoPress: from n/a through 3.51.0...
CVE-2026-73380
Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...
CVE-2026-73376
Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic 1.5.0 versions...
CVE-2026-73366
Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...
CVE-2026-73189
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-14858...
CVE-2026-73341
Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...