EUVD-2026-23145

Creolabs Gravity before 0.9.6 contains a heap buffer overflow vulnerability in the gravityvmexec function that allows attackers to write out-of-bounds memory by crafting scripts with many string literals at global scope. Attackers can exploit insufficient bounds checking in gravityfiberreassign t...

CVE-2026-3371

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authorization checks in the savecoursecontentorder private method, which is called unconditionally by the...

CVE-2026-39934 Growth Experiments ReassignMenteesJob runs as an infinite loop

Loop with unreachable exit condition 'infinite loop' vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Leveraging Time-of-Check and Time-of-Use TOCTOU Race Conditions. This issue was remediated only on the master branch...

CVE-2026-3139

The CVE-2026-3139 vulnerability affects the WordPress plugin “User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor” up to version 3.15.5. The issue is insecure direct object reference via wppb_save_avatar_value(), caused by missing validation on a user-contro...

CVE-2026-3139: Authorization Bypass Through User-Controlled Key

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.15.5 via the wppbsaveavatarvalue function due to missing validation on a user controlled key...

CVE-2026-28557

wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reassignment via the wpforosynchroles AJAX handler. Attackers access the usergroups admin page, accessible to any authenticated user, to obtain a nonce, then rema...

CVE-2026-28557 wpForo Forum < 2.4.16 Privilege Escalation via Role Synchronization Handler

wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reassignment via the wpforosynchroles AJAX handler. Attackers access the usergroups admin page, accessible to any authenticated user, to obtain a nonce, then rema...

The vulnerability of the “Vzlet SP” software suite is related to deficiencies in the authentication process. This allows a hacker to alter the user identifier to any desired value and reassign the user’s password.

The vulnerability of the “Vzlet SP” software suite is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to remotely alter the user identifier and reassign the user’s password...

PT-2026-3517

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on multiple AJAX actions in all versions up to, and including, 3.6.9. This makes it possible for authenticated attackers, with...

CVE-2025-12900

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 6.5.1 via the "ConvertController::insertToNewTable" function due to missing validation on a user controlled key. This makes it possible f...

CVE-2025-12900

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 6.5.1 via the "ConvertController::insertToNewTable" function due to missing validation on a user controlled key. This makes it possible f...

CVE-2025-12900

The CVE-2025-12900 entry concerns the WordPress FileBird plugin (FileBird – WordPress Media Library Folders & File Manager) with a vulnerability in all versions up to 6.5.1. Root cause: missing authorization in ConvertController::insertToNewTable due to insufficient validation on a user-controlle...

EUVD-2025-25176

Malicious code in bioql PyPI...

CVE-2025-4046

CVE-2025-4046 describes a Missing Authorization vulnerability in Lexmark Cloud Services badge management that could allow reassigning badges within an organization. Affected surface: Lexmark Cloud Services badge management component; root cause: insufficient access control enabling unauthorized r...

Lexmark Cloud Services 安全漏洞

Lexmark Cloud Services is a cloud-based suite of services from Lexmark, Inc. A security vulnerability exists in Lexmark Cloud Services that stems from a lack of authorization for badge management and could allow an attacker to reassign badges within an organization...

CVE-2025-4046: Missing Authorization

A missing authorization vulnerability in Lexmark Cloud Services badge management allows attacker to reassign badges within their organization...

Exploit for Type Confusion in Google Chrome

CVE-2024-4947 A in-the-wild V8 type confusion bug. This repo...

DEBIAN-CVE-2022-49416

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix use-after-free in chanctx code In ieee80211vifusereservedcontext, when we have an old context and the new context's replacestate is set to IEEE80211CHANCTXREPLACENONE, we free the old context in...

INITREFS() COULD BE USED TO OVERWRITE ALL REFFERAL DATA

Lines of code Vulnerability details Impact Although denoted as deprecated, initRefs is readily there in Referrals.sol that could be called by the owner whose private keys might have been compromised to reassign all the referral data. This could impact the referrers specifically who might have...

MediaWiki 安全漏洞

MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems. MediaWiki suffers from a security vulnerability that stems from the fact that an attacker can...