11970 matches found
CVE-2026-12687
The CVE describes a vulnerability in the ProfileGrid WordPress plugin prior to version 5.9.9.8 where the front-end registration does not restrict which group an anonymous visitor may join. This allows unauthenticated users to register directly into privileged groups and receive that group’s confi...
CVE-2026-12687 ProfileGrid < 5.9.9.8 - Unauthenticated Privilege Escalation via Unrestricted Group ID
The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration, allowing unauthenticated users to register directly into a privileged group and be granted that group's configured role, up to Administrator whe...
EUVD-2026-50992
The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration, allowing unauthenticated users to register directly into a privileged group and be granted that group's configured role, up to Administrator whe...
CVE-2026-14356
The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...
CVE-2026-64471
A flaw was found in the Linux kernel's Bluetooth subsystem btusb. When a Bluetooth controller fails to register, the system may not properly release associated interfaces. This can lead to a use-after-free or double-free memory error when these interfaces are later disconnected, potentially causi...
PT-2026-66370
The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration, allowing unauthenticated users to register directly into a privileged group and be granted that group's configured role, up to Administrator whe...
PT-2026-66494
Improper Isolation or Compartmentalization vulnerability in malach-it boruta Elixir.Boruta.Openid module allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.register client/3 forwards caller-supplied...
CVE-2026-18236
A vulnerability in the Agent Development Kit ADK allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject events into the session history can execute unauthorized tools by forging a tool confirmation response. This is possible because the framework di...
CVE-2026-18236 Google-ADK Continuation Forgery
A vulnerability in the Agent Development Kit ADK allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject events into the session history can execute unauthorized tools by forging a tool confirmation response. This is possible because the framework di...
CVE-2026-18236
Technical details are not publicly available in the provided documents. The ADK continuation forgery vulnerability description is repeated across sources without specifics on affected versions, exploit methods, or mitigations. Monitor for updates.
CVE-2026-64475
A flaw was found in the Linux kernel's vfio/pci subsystem. A missing cleanup operation during device registration could lead to a stale registration and a callback using freed memory. This vulnerability could result in system instability or potentially lead to a denial of service...
CVE-2026-65884
Joomla Extension - balbooa.com - Privilege Escalation in Gridbox 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permissions...
CVE-2026-65884
CVE-2026-65884 affects Joomla Extension Gridbox < 2.20.2 by Balbooa. The issue is in the registration method, which allows users with provided usergroup IDs to create new accounts with administrative permissions, enabling unauthenticated account creation with high privileges. Public references...
CVE-2026-65884 Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2
Joomla Extension - balbooa.com - Privilege Escalation in Gridbox 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permissions...
CVE-2026-65884 Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2
Joomla Extension - balbooa.com - Privilege Escalation in Gridbox 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permissions...
CVE-2026-18207
A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by joining a group with a matching name in a...
New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands
Gitea, the self-hosted Git platform, has patched a critical remote code execution vulnerability. A user with ordinary repository write access can turn attacker-controlled patch content into a live Git hook and run shell commands as the Gitea service account. Tracked as CVE-2026-60004 CVSS score:...
CVE-2026-63228 Unrestricted image upload vulnerability
An unrestricted image upload vulnerability in Koollab LMS allowed an authenticated attacker to upload malicious content disguised as an image file via the feedback mail registration endpoint, potentially enabling further attacks on the server...
PT-2026-65861
Name of the Vulnerable Software and Affected Versions Agent Development Kit affected versions not specified Description An issue allows for continuation forgery in tool confirmations. An attacker capable of manipulating or injecting events into the session history can execute unauthorized tools b...
PT-2026-65741
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the client policy enforcement mechanism where the system verifies group membership using names rather than unique identifiers. An attacker possessing client management...