93374 matches found
CVE-2026-12905 Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter
The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment method of the Mobile Staff Cabinet API resource=appointment, action=booklymobilestaffcabinet in...
CVE-2026-2497: Improper Neutralization of Special Elements used in an SQL Command
The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the 'galleryorderpostid' parameter array keys in all versions up to, and including, 4.7.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
Security Bulletin: This Power System update is being released to address CVE-2026-15961
Summary IBM PowerVM could allow a local attacker to obtain sensitive information or cause a denial of service due to improper control of format strings. Vulnerability Details CVEID:CVE-2026-15961 DESCRIPTION: IBM PowerVM could allow a local attacker to obtain sensitive information or cause a deni...
Sensitive Information Disclosure
Nuxt is vulnerable to Sensitive Information Disclosure. The vulnerability is due to the development server trusting an attacker-controlled Host header when validating local requests, which allows an unauthenticated network attacker to spoof the header and retrieve the project's absolute filesyste...
CVE-2026-18554
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...
CVE-2026-16905
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication...
CVE-2026-16915
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation...
CVE-2026-18554
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...
CVE-2026-17175
CVE-2026-17175 affects IBM Db2 Mirror for i (versions 7.4, 7.5, 7.6). Description: remote authenticated attacker could obtain sensitive information due to improper authentication enforcement. CVSS 3.1 base score 7.5 (HIGH), network attack vector, no user interaction required. Root cause: improper...
EUVD-2026-58795
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation...
CVE-2026-16905 IBM Db2 Mirror for i is affected by multiple vulnerabilities
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication...
CVE-2026-16905 IBM Db2 Mirror for i is affected by multiple vulnerabilities
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication...
Security Bulletin: IBM InfoSphere Information Server is vulnerable due to disclosure of sensitive information (CVE-2026-1014)
Summary A sensitive information disclosure vulnerability in IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2026-1014 DESCRIPTION: IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to exposure of sensitive information via JSON server respon...
CVE-2026-16905: Improper Authentication
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication...
PT-2026-72107
Name of the Vulnerable Software and Affected Versions IBM Db2 Mirror for i versions 7.4 through 7.6 Description A remote authenticated attacker can obtain sensitive information because the software does not properly limit pathnames to restricted directories. Recommendations At the moment, there i...
CVE-2026-74250: Sensitive Information in Resource Not Removed Before Reuse
In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface...
CVE-2026-17088
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability...
EUVD-2026-58474
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper processing of XML external entities...
CVE-2026-17649
CVE-2026-17649 affects IBM i 7.3–7.6 via the NetServer component. A remote attacker could obtain sensitive information due to an out-of-bounds read. IBM lists affected releases and provides PTF fixes: 7.6 MJ10939, 7.5 MJ10938, 7.4 MJ10937, 7.3 MJ10936 (see IBM bulletin). Base score ~5.3 (CVSS3.1)...