556 matches found
CVE-2026-112378
GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated user to access paid AI features without a valid subscription due to insufficient server-side...
CVE-2026-112378
The GitLab EE software is affected by a vulnerability where an authenticated user could access paid AI features without a valid subscription. This is caused by insufficient server-side validation during billing eligibility checks (CWE-348 ). The issue impacts versions 17.8 before 19.3.6 , 19.4 be...
CVE-2026-112378 Use of Less Trusted Source in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated user to access paid AI features without a valid subscription due to insufficient server-side...
CVE-2025-60375
CVE-2025-60375 CVE-2025-60375 — Authentication bypass / incorrect access control in PerfexCRM Note: Steps above are the original discovery steps reported by Ajansha Shankar and Ahamed Yaseen. References OWASP Authentication Cheat Sheet — gui...
GitLab 17.8 < 19.3.6 / 19.4 < 19.4.3 / 19.5 < 19.5.1 (CVE-2026-112378)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated...
CVE-2026-18795 Missing server side validation allowed user to quarantine a DM and GM post
Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756...
CVE-2026-18795
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, and 11.8.x
PT-2026-99774
Name of the Vulnerable Software and Affected Versions Bookly WordPress plugin versions prior to 28.3 Description Insufficient server-side validation of client-supplied booking quantity values allows unauthenticated users to manipulate the appointment total. By reducing the total to zero, an...
PT-2026-96057
Name of the Vulnerable Software and Affected Versions RestroPress WordPress plugin versions prior to 3.4.6 Description Insufficient server-side validation of client-supplied item add-on prices occurs when items are added to or updated in the cart. This allows unauthenticated users to manipulate t...
SPIP SSRF
The vulnerability of the SPIP content management system is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...
CVE-2026-20286
A vulnerability in the web-based management interface of Cisco Identify Services Engine ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side validation of Administrator permissions. An...
CVE-2026-20285 Cisco Identity Services Engine Authorization Bypass Vulnerability
A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-si...
EUVD-2026-81164
A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-si...
CVE-2026-20286 Cisco Identity Services Engine Authorization Bypass Vulnerability
A vulnerability in the web-based management interface of Cisco Identify Services Engine ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side validation of Administrator permissions. An...
PT-2026-93972
A vulnerability in the web-based management interface of Cisco Identify Services Engine ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side validation of Administrator permissions. An...
PT-2026-91395
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 performs input validation exclusively on the client side and fails to enforce the same restrictions on the server side. An attacker can modify requests to bypass validation controls and submit...
CVE-2026-87892
The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...
CVE-2026-87892 Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass
The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...
EUVD-2026-76803
The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...
CVE-2026-77793
The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without paying and obtain an activated account...