20510 matches found
CVE-2026-77003
The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...
CVE-2026-58003
WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the releaseVideoNow.json.php endpoint that lacks authenticity checks and accepts GET requests. Attackers can craft a malicious cross-site GET request carrying an administrator's session cookie to permanentl...
CVE-2026-58003 WWBN AVideo Cross-Site Request Forgery via releaseVideoNow.json.php
WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the releaseVideoNow.json.php endpoint that lacks authenticity checks and accepts GET requests. Attackers can craft a malicious cross-site GET request carrying an administrator's session cookie to permanentl...
CVE-2026-71880 Server-side template injection in Integrated Publishing Toolkit
Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection...
CVE-2026-71880
GBIF Integrated Publishing Toolkit (versions before 3.3.4) has a server-side template injection vulnerability in its template engine. Remote authenticated attackers with low privileges can inject untrusted input into templates, achieving high confidentiality and integrity impact (CVSS 7.6) by rea...
CVE-2026-71879 Authentication bypass in Integrated Publishing Toolkit
Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...
CVE-2026-71879
GBIF Integrated Publishing Toolkit versions before 3.3.4 leave initial setup functionality unauthenticated until first reboot, allowing remote authenticated attackers to bypass authentication and gain administrative control. CVSS 4.0 scores it 9.1 CRITICAL (network, low complexity, no privileges ...
CVE-2026-71879 Authentication bypass in Integrated Publishing Toolkit
Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...
CVE-2026-71879 Authentication bypass in Integrated Publishing Toolkit
Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...
CVE-2026-71878 Authentication bypass in Integrated Publishing Toolkit
Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...
CVE-2026-71878 Authentication bypass in Integrated Publishing Toolkit
Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...
CVE-2026-71878 Authentication bypass in Integrated Publishing Toolkit
Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...
CVE-2026-71878
GBIF Integrated Publishing Toolkit (IPT) before version 3.3.4 leaves initial setup functionality exposed after setup completion, enabling remote authenticated attackers to bypass authentication and gain administrative control; CVSS 4.0 scores this CRITICAL (9.2), with a fix available in version 3...
PT-2026-77248
Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass...
CVE-2026-68415
In the Linux kernel, the following vulnerability has been resolved: xfrm: clear mode callbacks after failed mode setup xfrmstategctask can run long after a failed IPTFS state setup. In the reproduced case, xfrminitstate cached x-modecbs, IPTFS setup returned -ENOMEM before publishing modedata, an...
CVE-2026-0637 Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products
When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values. A malicious actor with access to the 'wso2carbon' log files could retrieve sensiti...
CVE-2026-52520
Emlog CMS = 2.6.14 contains a stored cross-site scripting XSS vulnerability in the article publishing module /admin/article.php. A remote authenticated attacker can inject arbitrary JavaScript code via the article content. When an administrator reviews or previews the submitted article in the...
CVE-2026-52520
Emlog CMS = 2.6.14 contains a stored cross-site scripting XSS vulnerability in the article publishing module /admin/article.php. A remote authenticated attacker can inject arbitrary JavaScript code via the article content. When an administrator reviews or previews the submitted article in the...
EUVD-2026-52484
Emlog CMS = 2.6.14 contains a stored cross-site scripting XSS vulnerability in the article publishing module /admin/article.php. A remote authenticated attacker can inject arbitrary JavaScript code via the article content. When an administrator reviews or previews the submitted article in the...