Lucene search
+L

35924 matches found

RedhatCVE
RedhatCVE
added 2026/07/28 12:25 p.m.4 views

CVE-2026-14096

An object lifecycle issue flaw was found in the Input component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513310821...

6.5CVSS5.8AI score0.00229EPSS
SaveExploits0References5
Patchstack
Patchstack
added 2026/07/28 6:59 a.m.7 views

WordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin Jeg Kit for Elementor versions = 3.2.10...

5.5AI score
SaveExploits0Affected Software1
CVE
CVE
added 2026/07/28 6:0 a.m.18 views

CVE-2026-14926

The CVE describes a vulnerability in the FluentCart WordPress plugin prior to version 1.4.0 where several payment-method endpoints do not verify that a subscription belongs to the requesting customer. This IDOR-like flaw lets any authenticated user act on another user’s subscription—changing its ...

4.2CVSS5.9AI score0.00144EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/28 5:39 a.m.8 views

EUVD-2026-49693

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible...

4.3CVSS5.9AI score0.00218EPSS
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 2026/07/28 5:39 a.m.9 views

CVE-2026-16797

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible...

4.3CVSS5.9AI score0.00218EPSS
SaveExploits0References7
CVE
CVE
added 2026/07/28 5:39 a.m.19 views

CVE-2026-16797

ShopLentor – All-in-One WooCommerce Growth & Store Enhancement for WordPress (plugin) is affected up to version 3.4.5 by an Insecure Direct Object Reference via the optionSection parameter. The flaw arises from missing validation on a user-controlled key, enabling authenticated attackers with con...

4.3CVSS5.9AI score0.00218EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/07/28 5:39 a.m.35 views

CVE-2026-16797 ShopLentor <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'optionSection' Parameter

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible...

4.3CVSS0.00218EPSS
SaveExploits0References6
Nuclei
Nuclei
added 2026/07/28 5:35 a.m.231 views

CrushFTP < 10.5.1 - Unauthenticated Remote Code Execution

CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes. id: CVE-2023-43177 info: name: CrushFTP 10.5.1 - Unauthenticated Remote Code Execution author: iamnoooob,rootxharsh,pdresearch severity: critical description: | CrushFTP prior...

9.8CVSS7.4AI score0.81801EPSS
SaveExploits7References5
Tenable Nessus
Tenable Nessus
added 2026/07/28 12:0 a.m.7 views

SUSE SLED15 / SLES15 Security Update : python-pyasn1 (SUSE-SU-2026:3238-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3238-1 advisory. - CVE-2026-59884: BER/CER/DER decoder denial of service via unbounded long-form tag IDs bsc1271464. -...

7.5CVSS5.9AI score0.00349EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
added 2026/07/28 12:0 a.m.9 views

PT-2026-65610

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.51.0 through 0.60.1 Description Insufficient validation of x-python-type values in the get python type override function within src/datamodel code generator/parser/jsonschema.py allows attacker-controlled JS...

7.8CVSS5.9AI score0.00145EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2026/07/28 12:0 a.m.10 views

PT-2026-65520

Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can...

5.3CVSS5.8AI score0.00263EPSS
SaveExploits1References3
NVD
NVD
added 2026/07/27 10:17 p.m.10 views

CVE-2026-59240

The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...

6.9CVSS0.00288EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/27 9:37 p.m.5 views

CVE-2026-59240 IDOR in Prospero Flow CRM allows deletion of other users' notifications

The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...

6.9CVSS5.9AI score
SaveExploits0References6
Cvelist
Cvelist
added 2026/07/27 9:37 p.m.32 views

CVE-2026-59240 IDOR in Prospero Flow CRM allows deletion of other users' notifications

The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...

6.9CVSS0.00288EPSS
SaveExploits0References3
CVE
CVE
added 2026/07/27 9:37 p.m.19 views

CVE-2026-59240

The CVE-2026-59240 vulnerability is an IDOR in Prospero Flow CRM. Affected code path: DeleteNotificationController::delete() at GET /notification/delete/{id}. It allows any authenticated user to delete notifications belonging to any user because the target record is fetched with Notification::fin...

6.9CVSS5.9AI score0.00288EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/07/27 9:37 p.m.8 views

CVE-2026-59240

The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...

6.9CVSS5.9AI score0.00288EPSS
SaveExploits0References4Affected Software1
SUSE CVE
SUSE CVE
added 2026/07/27 5:11 p.m.12 views

SUSE CVE-2025-12044

Vault and Vault Enterprise “Vault” are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for +HCSEC-2025-24+|https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393...

7.5CVSS7.5AI score0.00529EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/27 4:17 p.m.3 views

UBUNTU-CVE-2026-51297

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

8.8CVSS7.5AI score0.00344EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/27 3:17 p.m.12 views

CVE-2026-59539

Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...

7.5CVSS0.00323EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/27 2:16 p.m.6 views

DEBIAN-CVE-2026-15003

A flaw was found in the GNU Binutils Binary Utilities linker. This vulnerability, a heap-buffer-overflow read CWE-125, occurs when the linker processes a specially crafted 32-bit XCOFF Extended Common Object File Format object file. An attacker could exploit this by providing a malicious file,...

5.6CVSS5.8AI score0.00106EPSS
SaveExploits0References1
Rows per page
Query Builder