20408 matches found
CVE-2026-62432
The EVTCHNOPexpandarray hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOPreset, resulting in dereferencing a NULL pointer...
EUVD-2026-49785
The EVTCHNOPexpandarray hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOPreset, resulting in dereferencing a NULL pointer...
CVE-2026-62432
The EVTCHNOPexpandarray hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOPreset, resulting in dereferencing a NULL pointer...
CVE-2026-62432 evtchn: Race between FIFO expand and reset
The EVTCHNOPexpandarray hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOPreset, resulting in dereferencing a NULL pointer...
CVE-2026-58338
A flaw was found in Moodle. The user profile page reset action did not properly implement a token to prevent Cross-Site Request Forgery CSRF. A remote attacker could exploit this vulnerability to perform unauthorized actions on behalf of an authenticated user, potentially leading to unintended...
CVE-2026-14545
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site...
CVE-2026-14545
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site...
CVE-2026-14545 TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site...
CVE-2026-14545 TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site...
EUVD-2026-49698
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site...
CVE-2026-14545
The TrueBooker WordPress plugin (versions before 1.2.4 ) is vulnerable to an unauthenticated account takeover due to a failure in validating account ownership. An attacker can exploit one of the plugin's front-end account handlers to reset a user's password. This allows an unauthenticated attacke...
Exploit for CVE-2026-8206
CVE-2026-8206 Vulnerability: Unauthenticated Account Takeo...
PT-2026-65569
The WP Password Policy plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 3.7.1. This is due to missing authorization checks and nonce verification in the get user function of the Module Password Hint class, which unconditionally calls WP User::set role...
PT-2026-65390
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site...
CVE-2026-65881: Initialization of a Resource with an Insecure Default
Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle 3.1.1 - The default configuration of the extension allowed read access and password reset of CMS accounts...
CVE-2026-14545: Improper Privilege Management
The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site...
PT-2026-65474
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The EVTCHNOP expand array hypercall checks if FIFO event channels are enabled without holding the required lock. This creates a race condition with EVTCHNOP rese...
EUVD-2026-49399
In the Synopsys DesignWare I2C driver drivers/i2c/i2cdw.c operating in target/slave mode, the rxfull interrupt handler gates the writerequested callback on dw-state != CMDSEND, and dw-state is only reset to READY on a STOP interrupt. The STARTDET interrupt, whose handler in...
CVE-2026-13332
The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions force-logout of any user on the site, including administrators...
PT-2026-65093
Name of the Vulnerable Software and Affected Versions Synopsys DesignWare I2C driver affected versions not specified Description When operating in target/slave mode, the rx full interrupt handler restricts the write requested callback based on the dw-state variable. Because the START DET interrup...