57 matches found
CVE-2026-52827 Kimai: Two-factor authentication bypass on the Kimai API
Kimai is an open-source time tracking application. Prior to 2.59.0, the KIMAISESSION cookie issued after password verification but before TOTP completion is accepted by every /api route because config/packages/security.yaml protects the API with ISAUTHENTICATED and...
CVE-2026-17018
The CubeWP Framework WordPress plugin (versions through 1.1.30 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw due to a lack of per-object read authorization checks and missing restrictions on metadata keys. This allows users with the Contributor role or higher to access arbitr...
CVE-2026-14943 Password Protected < 2.8.4 - Unauthenticated Sensitive Information Exposure via REST API
The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read...
CVE-2026-6072 Oliver POS <= 2.4.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to 'OliverAuth' Header
The Oliver POS – A WooCommerce Point of Sale POS plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.4.2.6. The plugin protects its entire /wp-json/pos-bridge/ REST API namespace through the oliverposrestauthentication...
Exploit for CVE-2025-24000
CVE-2025-24000 — Post SMTP Privilege Escalation Exploit Ov...
CVE-2026-2694
The The Events Calendar plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to an improper capability check on the 'canedit' and 'candelete' function in all versions up to, and including, 6.15.16. This makes it possible for authenticated attackers, with...
CVE-2024-39715
A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC server using REST API, leading to remote code execution on VSPC server...
GHSA-V3F3-RF6R-43X5 Jenkins Coverage Plugin has a stored cross-site scripting (XSS) vulnerability
Jenkins Coverage Plugin 2.3054.ve1ff7baa123b and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier ...
EUVD-2020-29459
Malware in sbrugna...
EUVD-2021-24568
Malware in sbrugna...
EUVD-2021-22845
Malware in sbrugna...
EUVD-2022-33500
Malicious code in bioql PyPI...
EUVD-2022-52769
Malicious code in bioql PyPI...
EUVD-2022-51762
Malicious code in bioql PyPI...
EUVD-2024-16473
Malicious code in bioql PyPI...
EUVD-2024-34996
Malicious code in bioql PyPI...
EUVD-2024-16471
Malicious code in bioql PyPI...
EUVD-2025-17687
Malicious code in bioql PyPI...