Lucene search
+L

123737 matches found

CVE
CVE
added 2026/09/17 5:15 p.m.5 views

CVE-2026-54676

Scoold , a Q&A and knowledge-sharing platform for teams, is affected by an authorization bypass in ApiController.getPostReplies() (file ApiController.java). Prior to 1.69.0 , the GET /api/posts/{id}/answers endpoint did not call canAccessSpace before returning reply data, allowing users holding a...

6.5CVSS0.00244EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/09/17 5:15 p.m.29 views

CVE-2026-54676 Scoold: GET /api/posts/{id}/answers leaks private-space replies when personal API tokens are enabled

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot access because src/main/java/com/erudika/scoold/api/ApiController.java in ApiController.getPostReplies does not apply...

6.5CVSS0.00244EPSS
SaveExploits0References3
Kitploit
Kitploit
added 2026/09/17 4:14 p.m.12 views

CVE-2014-2734

CVE-2014-2734 Suplantación de clave privada de CA en Ruby OpenSSL ============= Ruby openssl tiene una vulnerabilidad cuando una clave pública se emite antes de escribir la clave privada y se reabre durante un script, suplantando una clave privada de CA. Script PoC https://gist.github.com/1044654...

5.8CVSS7.8AI score0.05349EPSS
SaveExploits2References1
Kitploit
Kitploit
added 2026/09/17 3:34 p.m.9 views

debianopenssl

debianopenssl Claves privadas vulnerables al fallo de OpenSSL en Debian CVE-2008-0166 En 2008, un fallo en el paquete OpenSSL de Debian y Ubuntu provocó la generación de claves privadas predecibles. Aunque el número de claves es limitado, se necesitan algunas consideraciones para crear una lista...

7.8CVSS7.1AI score0.70721EPSS
SaveExploits11References4
Kitploit
Kitploit
added 2026/09/17 1:46 p.m.37 views

bucket-stream

🚨 Bucket Stream is no longer maintained. If you need support or consultation for your red teaming endeavours, drop me an e-mail [email protected] 🚨 Bucket Stream Find interesting Amazon S3 Buckets by watching certificate transparency logs. This tool simply listens to various certificate...

5.8AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/17 1:26 p.m.10 views

Bluetooth-Attacks-CVE-2025-27840

Este artículo analiza cómo un atacante puede introducir una lista oculta de vulnerabilidades a través de actualizaciones de módulos, lo que puede comprometer dispositivos ESP32 y obtener acceso no autorizado a claves privadas, afectando a miles de millones de dispositivos que utilizan este...

6.8CVSS7AI score0.0133EPSS
SaveExploits1References19
Kitploit
Kitploit
added 2026/09/17 6:24 a.m.7 views

terrapod-PoC

Terrapod: security advisory CVE status: requested, pending assignment. This finding is published as GHSA-6qrc-597p-mrp9. On CVE assignment this repository is renamed CVE-YYYY-NNNNN-terrapod-PoC and this banner is replaced with the CVE link. | ---|--- Researcher| Dostxodjayev Abdullox @squeeze440...

6.1AI score
SaveExploits0References3
NVD
NVD
added 2026/09/17 6:16 a.m.6 views

CVE-2026-86707

The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...

9.8CVSS0.00277EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/17 6:00 a.m.7 views

EUVD-2026-81357

The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowing unauthenticated attackers to read any author's draft, pending and private car listings - including titles, prices, media URLs and seller...

5.3CVSS0.00193EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/17 6:00 a.m.23 views

CVE-2026-86707 Private Feed Key <= 0.1 - Unauthenticated Authentication Bypass via 'feedkey' Parameter

The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...

0.00277EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/17 6:00 a.m.6 views

EUVD-2026-81339

The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...

9.8CVSS0.00277EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/17 6:00 a.m.18 views

CVE-2026-86707

The Private Feed Key WordPress plugin (through 0.1 ) suffers from an unauthenticated authentication bypass via the feedkey parameter. The plugin fails to verify that the key supplied in a feed request is one it issued, instead matching the key against any stored user metadata value . This allows ...

9.8CVSS0.00277EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.177 views

Gitea Container Registry - Unauthorized Private Image Access

Gitea = 1.26.2. As a temporary workaround, set REQUIRESIGNINVIEW=true in gitea app.ini, though this blocks all anonymous access including public repos. reference: - https://blog.gitea.com/release-of-1.26.2/ - https://github.com/go-gitea/gitea/pull/37290 -...

8.2CVSS7.7AI score0.01393EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.28 views

WordPress <= 5.2.4 - Unauthenticated View Private/Draft Posts

WordPress before 5.2.4 contains an information disclosure caused by mishandling of the static query property, letting unauthenticated users view certain content, exploit requires no authentication. id: CVE-2019-17671 info: name: WordPress = 5.2.4 - Unauthenticated View Private/Draft Posts author:...

5.3CVSS6.9AI score0.36503EPSS
SaveExploits3References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.36 views

WordPress Simple Job Board - Unauthorized Data Access

The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetchquickjob function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be...

5.3CVSS6.8AI score0.00909EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.92 views

PrivateGPT < 0.5.0 - Open Redirect

An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter. This vulnerability allows attackers to redirect users to a URL specified by user-controlled input without proper validation or sanitization. id: CVE-2024-5936 info: name:...

6.1CVSS5.4AI score0.30074EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.26 views

YMC Filter WordPress - Unauthenticated Post Disclosure

YMC Filter WordPress plugin 3.11.3 contains a broken access control vulnerability caused by improper authorization and lack of validation in a REST API endpoint, letting unauthenticated attackers retrieve private and non-public post content, exploit requires no authentication. id: CVE-2026-10823...

7.5CVSS5.7AI score0.01524EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.43 views

Premium Addons for Elementor - Unauthenticated Information Disclosure

Premium Addons for Elementor plugin for WordPress version 4.11.53 and below contains an unauthenticated information disclosure vulnerability.The vulnerability exists due to a missing authorization check in the gettemplatecontent AJAX handler, allowing unauthenticated attackers to retrieve private...

5.3CVSS5.7AI score0.00764EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.6 views

Discourse - Private User Field Disclosure via Directory Items IDOR

Discourse prior to 2025.12.2, 2026.1.1, and 2026.2.0 contains an IDOR vulnerability caused by lack of authorization checks on userfieldids parameter in DirectoryItemsControllerindex, letting any user retrieve private user field values, exploit requires no authentication. id: CVE-2026-26265 info:...

7.5CVSS5.7AI score0.00877EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.208 views

My Calendar WordPress Plugin - Information Disclosure

My Calendar WordPress plugin = 3.7.6 contains an injection vulnerability caused by unvalidated user input passed to parsestr in mcajaxmcjsaction endpoint, letting unauthenticated attackers access or crash sites via switchtoblog, exploit requires WordPress Multisite or Single Site setup. id:...

8.8CVSS5.8AI score0.00932EPSS
SaveExploits0References2
Rows per page
Query Builder