CVE-2026-28648

In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28648

A permission bypass vulnerability exists in Settings due to a confused deputy flaw. This issue allows for local escalation of privilege without requiring additional execution privileges or user interaction. No specific software version, exploit links, or remediation steps are provided in the docu...

EUVD-2026-92630

In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

WordPress TrueBooker plugin <= 1.2.9 - Settings Change vulnerability

Settings Change vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin TrueBooker versions = 1.2.9...

WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerability

Settings Change vulnerability discovered by Filip Kecman in WordPress Plugin PayPlug for WooCommerce Official versions = 3.1.0...

CVE-2026-102776

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...

CVE-2026-102776 Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...

EUVD-2026-92451

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...

CVE-2026-102776 Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...

Astra Linux – Vulnerability in Tomcat9

There is a vulnerability in Apache Tomcat related to uncontrolled resource consumption, especially when an HTTP/2 client does not acknowledge the initial settings frame that reduces the maximum number of concurrent streams allowed. This issue affects Apache Tomcat versions as follows: from...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the Settings section of Google Chrome prior to version 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform privilege escalation through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

A heap buffer overflow in the Settings component of Google Chrome prior to version 95.0.4638.54 allowed a remote attacker to interact with Dev Tools, potentially exploiting heap corruption through a crafted HTML page...

PT-2026-106011

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the form token: setting the default payment method, shipping method, image type set, order status an...

CVE-2026-28648: Unintended Proxy or Intermediary

In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-106143

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A permission bypass exists in Settings caused by a confused deputy, a situation where a privileged entity is tricked by a less privileged one into performing an...

chef-os-hardening

os-hardening Chef cookbook 1 2 Descrizione Questo cookbook fornisce numerose configurazioni relative alla sicurezza, offrendo una protezione di base completa. Configura: Configura la gestione dei pacchetti, ad esempio consente solo pacchetti firmati Rimuove i pacchetti con problemi noti Configura...

CVE-2026-104119

The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite...

CVE-2026-104119 Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials

The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite...

EUVD-2026-92073

The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite...

CVE-2026-104119 Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials

The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite...