150423 matches found
CVE-2026-93528 NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page
The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key...
WordPress NP Quote Request for WooCommerce plugin 2.0-2.4.15 - Unauthenticated Order Data Disclosure vulnerability
Unauthenticated Order Data Disclosure vulnerability discovered by Murad Islamzada in WordPress Plugin NP Quote Request for WooCommerce versions 2.0-2.4.15...
EUVD-2026-85064
The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key...
CVE-2026-84168 Easy Hide Login < 1.7 - Login Page Protection Bypass / Hidden URL Disclosure
The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through certain password-reset request parameters and to recover the site's configured secret login slug from the returned page...
CVE-2026-84168 Easy Hide Login < 1.7 - Login Page Protection Bypass / Hidden URL Disclosure
The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through certain password-reset request parameters and to recover the site's configured secret login slug from the returned page...
Malicious code in helpersutils-dev-tools (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b7208dea3cf1742ac01332c17db9df968fd4a105fbccaf0b5388162b0f3673 The package presents itself as 'Development utility helpers' but its main module executes an IIFE at require-time that issues an Image request to...
MAL-2026-16465 Malicious code in helpersutils-dev-tools (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b7208dea3cf1742ac01332c17db9df968fd4a105fbccaf0b5388162b0f3673 The package presents itself as 'Development utility helpers' but its main module executes an IIFE at require-time that issues an Image request to...
CVE-2026-95930
A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiat...
CVE-2026-95930 iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery
A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiat...
CVE-2026-95930 iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery
A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiat...
CVE-2026-95930
The iFlytek astron-agent (up to version 1.0.6 ) is vulnerable to a server-side request forgery (SSRF) . The flaw exists in the UrlCheckTool.checkUrl function within the debugToolV2 API endpoint, where a remote attacker can manipulate the endPoint argument to initiate unauthorized requests. To rem...
CVE-2026-95930 iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery
A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiat...
EUVD-2026-85001
A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiat...
EUVD-2026-84959
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information and trigger unauthorized actions due to server-side request forgery...
SUSE CVE-2026-93710
Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compilehooks. A hook that dies fires core.app.hookexception, then calls cleanup unless the failing hook is the exception handler. A handler that halts does...
CVE-2026-76086: Missing Authorization
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a...
CVE-2026-96446: Missing Authorization
A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that...
PT-2026-97173
The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through certain password-reset request parameters and to recover the site's configured secret login slug from the returned page...
PT-2026-97553
Name of the Vulnerable Software and Affected Versions sfturing hosp order versions up to 627f426331da8086ce8fff2017d65b1ddef384f8 Description A remote attack can lead to cross-site request forgery, which occurs when a malicious site tricks a user's browser into performing an unwanted action on a...
.NET Visual Studio Code HTTP Request Disclosure
The vulnerability of the .NET software platform and the code editor Visual Studio Code is related to deficiencies in HTTP request processing. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...