44841 matches found
CVE-2026-65917
CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference IDOR vulnerability in the IncBackups application's incremental-backup handlers deleteBackup, fetchRestorePoints, and restorePoint that allows authenticated panel users to access or manipulate other...
EUVD-2026-48307
CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference IDOR vulnerability in the IncBackups application's incremental-backup handlers deleteBackup, fetchRestorePoints, and restorePoint that allows authenticated panel users to access or manipulate other...
CVE-2026-65917
CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference IDOR vulnerability in the IncBackups application's incremental-backup handlers deleteBackup, fetchRestorePoints, and restorePoint that allows authenticated panel users to access or manipulate other...
CVE-2026-65917 CyberPanel IncBackups IDOR via Sequential Backup ID
CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference IDOR vulnerability in the IncBackups application's incremental-backup handlers deleteBackup, fetchRestorePoints, and restorePoint that allows authenticated panel users to access or manipulate other...
CVE-2026-65917
CyberPanel
CVE-2026-65917 CyberPanel IncBackups IDOR via Sequential Backup ID
CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference IDOR vulnerability in the IncBackups application's incremental-backup handlers deleteBackup, fetchRestorePoints, and restorePoint that allows authenticated panel users to access or manipulate other...
NPM: Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
NPM: Auth.js: Configuration errors can cause existence-based auth checks to fail open auth object populated with an error vulnerability discovered by ? in WordPress Npm next-auth versions = 5.0.0-beta.0, = 5.0.0-beta.31...
GHSA-8FPG-XM3F-6CX3 Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
Impact next-auth Auth.js v5 applications that gate access by checking only for the existence of the auth object — the pattern shown in the official session management / protecting resources guide — are affected. When the Auth.js configuration produces a server-side error, the auth object exposed ...
Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
Impact next-auth Auth.js v5 applications that gate access by checking only for the existence of the auth object — the pattern shown in the official session management / protecting resources guide — are affected. When the Auth.js configuration produces a server-side error, the auth object exposed ...
WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure vulnerability
Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure vulnerability discovered by Abu Hurayra HurayraIIT in WordPress Plugin Kirki versions = 6.0.14...
DEBIAN-CVE-2026-15037
Improper output neutralization XML injection in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under th...
CVE-2026-65904
DOMPurify through 3.3.3 fails to sanitize DOM elements passed via INPLACE mode when the element originates from a different window/realm e.g., an iframe's contentDocument. A cross-realm instanceof check in the private isNode function returns false for foreign-realm nodes, causing DOMPurify to...
EUVD-2026-48269
DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...
kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()
A flaw was found in the Linux kernel's Direct Rendering Manager DRM Graphics Execution Manager GEM component. This vulnerability arises from an inconsistent calculation of plane dimensions, which can lead to incorrect memory allocation checks. A local attacker could exploit this by creating a...
EUVD-2026-48254
Improper output neutralization XML injection in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under th...
CVE-2026-65497
Administrator PHP Object Injection in Complianz = 7.5.0 versions...
CVE-2026-65501
Unauthenticated Insecure Direct Object References IDOR in Shiptastic for WooCommerce = 5.1.0 versions...
CVE-2026-65493
Subscriber PHP Object Injection in Dokan Pro = 5.0.2 versions...