91137 matches found
CVE-2026-28571: Missing Authorization
Unauthenticated Broken Access Control in FormyChat = 2.15.7 versions...
CVE-2026-15585: Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. AKINSOFT Wolvox9 ERP / KontrolPanel.exe allows Path Traversal. This issue affects AKINSOFT Wolvox9 ERP / KontrolPanel.exe: from s26.02.17 befo...
CVE-2026-19447: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Fileorbis Informatics Services Trade Inc. FileOrbis allows Stored XSS. This issue affects FileOrbis: before 16.5...
CVE-2026-23934: Asymmetric Resource Consumption (Amplification)
An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service...
CVE-2026-23931: Observable Discrepancy
The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality...
CVE-2026-23930: Asymmetric Resource Consumption (Amplification)
An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service...
CVE-2026-23922: Insufficiently Protected Credentials
The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint...
CVE-2026-16309: Authorization Bypass Through User-Controlled Key
Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EdoWEB: before 780-g7...
CVE-2026-73187: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in Sticky Chat Widget = 1.4.2 versions...
CVE-2026-68567: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Convert Pro = 1.0.1 versions...
CVE-2026-66645: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Table Of Contents Block = 1.5.0 versions...
CVE-2026-32553: Server-Side Request Forgery (SSRF)
Unauthenticated Server Side Request Forgery SSRF in OttoKit = 1.1.35 versions...
CVE-2026-32474: Unrestricted Upload of File with Dangerous Type
Contributor Arbitrary File Upload in Templatiq = 0.2.5 versions...
CVE-2026-74007: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery = 1.16.20 versions...
CVE-2026-73995: Authentication Bypass by Spoofing
Subscriber Broken Authentication in User Registration = 5.2.6 versions...
CVE-2026-73397: Deserialization of Untrusted Data
Unauthenticated Deserialization of untrusted data in Youzify = 1.3.7 versions...
CVE-2026-73395: Authorization Bypass Through User-Controlled Key
Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...
CVE-2026-73380: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...