CVE-2026-94127 BIG-IP APM OAuth vulnerability

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution RCE. This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth...

K000162605: BIG-IP APM vulnerability CVE-2026-94127

Security Advisory Description When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution RCE. This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments...

CVE-2026-13355

The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populateviaquerystring function in the mb-frontend-submission component unconditionally overrides the form's target objectid fr...

CVE-2026-13355

The Meta Box AIO WordPress plugin (versions ≤ 3.11.0 ) is vulnerable to unauthenticated Privilege Escalation to Administrator due to a chained flaw in its bundled components. The mb-frontend-submission component lacks authorization checks in the populate_via_query_string() function, allowing atta...

CVE-2026-13355: Improper Privilege Management

The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populateviaquerystring function in the mb-frontend-submission component unconditionally overrides the form's target objectid fr...

CVE-2026-94534

lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex...

CVE-2026-94534 lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints

lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex...

CVE-2026-94534

lamp-cloud through version 5.10.0 contains a Broken Object Level Authorization (BOLA) flaw in the PUT /anyone/baseInfo and PUT /anyone/avatar endpoints within its OAuth module. The root cause is a failure to validate that the target user ID in the request body matches the authenticated caller, al...

CVE-2026-94532

lamp-cloud through 5.10.0 contains an authorization bypass in the getUserInfoById endpoint of its OAuth module. Any authenticated user can iterate the userId parameter to retrieve other users' full profiles, exposing mobile numbers, email addresses, national identity card numbers, and WeChat/Ding...

CVE-2026-94532 lamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoById

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows authenticated users to read any other user's full profile. Attackers can iterate the userId parameter to harvest sensitive user information including mobile numbers, email addresse...

CVE-2026-84134

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Other issue in the Profile Backup component...

CVE-2026-80110 Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpoint

A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both...

CVE-2026-94152

A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Profile API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The...

EUVD-2026-83866

A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Profile API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The...

CVE-2026-94152

Omega Solution FBP Fulfillment by People 2025 contains an authorization bypass in the User Profile API (file /user/). The vulnerability is triggered by manipulating the ID argument , allowing a low-privileged remote user to access unauthorized user profiles. The impact is a low confidentiality lo...

CVE-2026-94152 Omega Solution FBP Fulfillment by People User Profile API user authorization

A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Profile API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The...

CVE-2026-94213 Keycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identity

A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific users. Due to missing authorization check...

CVE-2026-94534: Authorization Bypass Through User-Controlled Key

lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex...

CVE-2026-94152: Authorization Bypass Through User-Controlled Key

A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Profile API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The...

CVE-2026-85680

The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to sto...