26184 matches found
CVE-2026-66076: Missing Authorization
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, isauthorized/2 calls rabbitmgmtutil:isauthorized/2, which checks only the management tag, instead of isauthorizedvhost/2. The /api/queues/quorum/:vhost/:queue/status handler reads the vhost...
PT-2026-97167
Name of the Vulnerable Software and Affected Versions Email Subscribers & Newsletters WordPress plugin versions prior to 5.9.35 Description The plugin fails to verify the per-subscriber management token when modifying a subscriber's subscription status. This allows unauthenticated users to...
CVE-2026-95814
Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization ciphers. Attackers with revoked or pending membership can...
CVE-2026-63104
Kaneo versions 2.3.12 before 2.12.2 are vulnerable to a missing authorization flaw in the bulk task endpoint . While the system verifies workspace membership, it fails to invoke the role-based permission checks required for other task endpoints. Authenticated workspace members with viewer or memb...
EUVD-2026-84564
Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a caller-controlled --socketpath from the low-privileged netdata service account. The account can direct root fail2ban-client...
CVE-2026-83603
The open source observability tool Netdata contains a privilege escalation vulnerability in the setuid-root ndsudo helper command (fail2ban-client-status-socket) located in src/collectors/utils/ndsudo.c. A low-privileged netdata service account can provide a caller-controlled --socket_path to dir...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gnupg2 (UTSA-2026-054045)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054045 advisory. GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints e.g., use of GPGME ar...
CVE-2026-83603: External Control of File Name or Path
Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a caller-controlled --socketpath from the low-privileged netdata service account. The account can direct root fail2ban-client...
CVE-2026-49811
creationtimestamp| type| source ---|---|--- 2026-09-21 19:54:48+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117310782694338907 2026-09-22 00:05:00+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mw2wj2c6es2l...
SUSE CVE-2026-90070
In the Linux kernel, the following vulnerability has been resolved: tpm: st33zp24: Return zero on status read failure st33zp24status ignores the result of the transport read and returns data even when no byte was received. The I2C transport, for example, skips i2cmasterrecv when the register-sele...
PT-2026-96117
Name of the Vulnerable Software and Affected Versions GoCD versions prior to 26.1.0 Description The internal GoCD UI '/jobStatus.json' API fails to validate if a requested server-assigned job ID belongs to the specified pipeline and stage. This allows an authenticated user to guess job IDs and...
PT-2026-96060
Name of the Vulnerable Software and Affected Versions Payment Gateway for PayPal on WooCommerce WordPress plugin versions prior to 9.2.1 Description An issue exists where the plugin fails to verify if an incoming payment notification was confirmed within the store's configured payment environment...
WordPress Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit plugin 3.6.1-5.4.6 - Unauthenticated Order Status Manipulation vulnerability
Unauthenticated Order Status Manipulation vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Rede Itaú for WooCommerce versions 3.6.1-5.4.6...
CVE-2026-92430
The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin, affecting versions 3.6.1-5.4.6 , contains an unauthenticated order status manipulation vulnerability. The root cause is the failure to verify the authenticity of its PIX payment webhook before updating an order's...
CVE-2026-92430 Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webhook
The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying...
CVE-2026-92430 Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webhook
The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying...
EUVD-2026-83516
The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying...
CVE-2026-92430: Missing Authorization
The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying...
PT-2026-95769
Name of the Vulnerable Software and Affected Versions Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin versions prior to 5.4.7 Description The plugin fails to verify the authenticity of its PIX payment webhook before updating the status of an order. This allows...