16744 matches found
CVE-2026-15411
The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0. This is due to the plugin not properly verifying that a user is authorized to perfor...
CVE-2026-14169
Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device...
CVE-2026-14169 ads-tec Industrial IT: Account lockout via non-atomic user creation
Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device...
CVE-2026-14169
Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device...
CVE-2026-14169
Technical details are not publicly available in the provided documents. Monitor for updates.
EUVD-2026-49730
Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device...
CVE-2026-14924
The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published posts and to overwrite arbitrary existing posts and pages...
CVE-2026-14924
CVE-2026-14924 affects the Tablesome Table WordPress plugin prior to version 1.1.31. The issue arises because one AJAX action does not perform authentication, capability, or nonce checks, allowing unauthenticated users to create new published posts and overwrite arbitrary existing posts and pages...
CVE-2026-14924
The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published posts and to overwrite arbitrary existing posts and pages...
EUVD-2026-49702
The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published posts and to overwrite arbitrary existing posts and pages...
CVE-2026-16587
The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-16587
Technical details for CVE-2026-16587 are not publicly available in the provided documents. Monitor for updates.
CVE-2026-16587 Advanced Form Integration <= 2.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary MailUp OAuth Token Overwrite via auth_redirect() Function
The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
PT-2026-65624
Name of the Vulnerable Software and Affected Versions goshs versions prior to 2.1.4 Description In the WebDAV implementation, the wdGuard function in httpserver/server.go incorrectly classifies the MOVE method as a write-only operation. Consequently, it fails to enforce the --no-delete flag...
PT-2026-65416
Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a security bypass in python-dotenv [CVE-2026-28684]
Summary IBM Watson Speech Services Cartridge is vulnerable to a security bypass in python-dotenv, due to a flaw allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. CVE-2026-28684. Python-dotenv is used in our speech...
K000162461: PostgreSQL vulnerability CVE-2026-6475
Security Advisory Description Symlink following in PostgreSQL pgbasebackup plain format and in pgrewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these...
CVE-2026-55973
A flaw was found in Unbound. When the 'dns-error-reporting: yes' option is enabled, a remote attacker can send a specially crafted DNS response containing a malformed EDNS Report-Channel option from a delegated zone they control. This can lead to a stack variable overwrite, causing the Unbound...
CVE-2026-65010
A flaw was found in Hugging Face Datasets through 5.00 in Extractor.extract. When archive contents are extracted to predictable output paths, the extractor follows pre-planted symlinks instead of confining writes to the intended directory. A local attacker who can place those symlinks can redirec...
