25116 matches found
CVE-2026-78125 LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure
The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...
CVE-2026-78125
The LearnPress – Sepay Payment WordPress plugin before version 4.0.3 (all versions up to and including 4.0.2) fails to perform any authorization check on one of its REST endpoints. This allows unauthenticated attackers to enumerate order identifiers and disclose the payment status of arbitrary or...
CVE-2026-80521
creationtimestamp| type| source ---|---|--- 2026-08-27 01:57:01+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117164986929423742...
CVE-2026-55227 Observable object existence disclosure in private Weblate projects via globally scoped object lookups
Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 Forbidden instead of 404 Not Found when a user requests an object they a...
CVE-2026-81033
Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account...
EUVD-2026-66609
Automatisch reveals whether an address is registered through the response to its forgot-password request. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js looks the address up and chains a not-found throw onto the query, so an address with no account...
CVE-2026-81033
Automatisch (through v0.15.0 ) exposes a user enumeration vulnerability through its forgot-password endpoint. The controller at packages/backend/src/controllers/internal/api/v1/users/forgot-password.js returns a not-found status for unregistered addresses but a no-content status for registered on...
CVE-2026-74932
creationtimestamp| type| source ---|---|--- 2026-08-26 12:00:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtybw3pt6m2u...
CVE-2026-77551
creationtimestamp| type| source ---|---|--- 2026-08-26 12:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtybuvhrho24 2026-08-27 07:00:03+00:00| seen| https://t.me/GithubRedTeam/99900 2026-08-27 16:00:04+00:00| seen| Telegram/EP2u8OGan0flSGLl45h1b-LiiKVRCNQN1i62iKzOsOD7LI...
PT-2026-82221
Name of the Vulnerable Software and Affected Versions Automatisch affected versions not specified Description An information disclosure issue exists in the forgot-password functionality. The endpoint '/api/v1/users/forgot-password' allows an unauthenticated user to determine if a specific address...
PT-2026-82296
Name of the Vulnerable Software and Affected Versions Weblate versions prior to 2026.7 Description Several endpoints perform object lookups using a global scope instead of restricting the search to projects the user is authorized to access. Consequently, the system returns an HTTP 403 Forbidden...
CVE-2026-65089
NVIDIA NemoClaw for Linux contains a vulnerability in its status and logs plugin commands, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service...
CVE-2026-65089
NVIDIA NemoClaw for Linux contains a vulnerability in its status and logs plugin commands, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service...
EUVD-2026-66098
NVIDIA NemoClaw for Linux contains a vulnerability in its status and logs plugin commands, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service...
CVE-2025-26238
creationtimestamp| type| source ---|---|--- 2026-08-25 17:06:14+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117157237468161259...
CVE-2026-19949
creationtimestamp| type| source ---|---|--- 2026-08-25 12:49:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ieoz7errhefg6 2026-09-01 17:28:44+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3muhx23vr4q2b 2026-09-02 22:22:13+00:00| seen|...
ROOT-OS-DEBIAN-12-CVE-2025-7545 CVE-2025-7545 in binutils - Patched by Root
Root has patched CVE-2025-7545 in the binutils package for Root:Debian:12. Multiple fixed versions available...
ROOT-OS-DEBIAN-12-CVE-2018-9996 CVE-2018-9996 in binutils - Patched by Root
Root has patched CVE-2018-9996 in the binutils package for Root:Debian:12. Multiple fixed versions available...
CVE-2026-10627 Events Manager <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parameters
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.4.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...