Lucene search
+L

58106 matches found

CVE
CVE
added 2026/08/25 9:00 a.m.3 views

CVE-2026-77128

The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires on...

6.3CVSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/25 2:26 a.m.4 views

EUVD-2026-65271

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.4.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

5.3CVSS5.4AI score
SaveExploits0References12
CVE
CVE
added 2026/08/25 2:26 a.m.13 views

CVE-2026-10627

The Events Manager plugin for WordPress (versions up to and including 7.4.0 ) is vulnerable to an authorization bypass via the status , private , and private_only parameters, which are not properly validated. This allows unauthenticated attackers to view the titles, dates, descriptions, and locat...

5.3CVSS5.5AI score
SaveExploits0References12
EUVD
EUVD
added 2026/08/25 12:30 a.m.7 views

EUVD-2026-65175

Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads = 1.2.0 versions...

7.5CVSS5.2AI score
SaveExploits0References2
CVE
CVE
added 2026/08/24 9:31 p.m.9 views

CVE-2026-78264

CVE-2026-78264 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the WordPress Toolset Blocks plugin in versions 1.6.26 and earlier . The CNA (Patchstack) assigns a CVSS 3.1 base score of 7.1 (HIGH) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating a network-explo...

7.1CVSS5AI score
SaveExploits0References1
EUVD
EUVD
added 2026/08/24 8:09 p.m.12 views

EUVD-2026-63565

django CMS: Plugin move endpoint allows cyclic reparenting DoS...

7.1CVSS5.1AI score0.00345EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/24 6:50 p.m.18 views

CVE-2026-39975 Combodo iTop: Remote code execution using external auth variable value

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, unauthenticated users could delete the .readonly file on iTop instances, leading to code execution. This file, created during the setup process, prevents users from performing write actions. This issue has been fixed in versi...

9.4CVSS
SaveExploits0References1
NVD
NVD
added 2026/08/24 2:17 p.m.9 views

CVE-2026-78386

RansomLook exposed sensitive operator-side scraping configuration through multiple unauthenticated API responses. Location records associated with ransomware groups and markets were returned largely verbatim to unauthenticated callers whenever the location itself was not marked as private. These...

8.7CVSS
SaveExploits0References1
NVD
NVD
added 2026/08/24 2:17 p.m.7 views

CVE-2026-78370

RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to remain private. The /export/ endpoint permits selected internal databases to be exported without requiring authentication. While...

9.2CVSS
SaveExploits0References1
NVD
NVD
added 2026/08/24 2:17 p.m.7 views

CVE-2026-78378

Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlled input before it is incorporated into Redis SCAN MATCH patterns. The /api/health/ endpoint attempted to resolve the supplied name to a known group or market, but when resolutio...

6.9CVSS
SaveExploits0References1
NVD
NVD
added 2026/08/24 2:16 p.m.7 views

CVE-2026-67602

phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an...

9.3CVSS
SaveExploits0References3
CVE
CVE
added 2026/08/24 1:57 p.m.13 views

CVE-2026-67602

phpIPAM before 1.8.2 contains an authentication bypass in its REST API caused by an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, so an entry written during an app_id lookup can satisfy a subsequent app_code lookup. This al...

9.3CVSS5.4AI score
SaveExploits0References3
EUVD
EUVD
added 2026/08/24 1:57 p.m.9 views

EUVD-2026-64889

phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an...

9.3CVSS5.4AI score
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/24 1:57 p.m.19 views

CVE-2026-67602 phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache

phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an...

9.3CVSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2026/08/24 1:29 p.m.6 views

CVE-2026-68520

A flaw was found in Glances, an open-source system monitoring tool. A remote unauthenticated attacker could exploit a vulnerability in the asdictsecure function, which incorrectly handles option names. This flaw leads to the exposure of sensitive information, including usernames and credentials...

5.3CVSS5.4AI score0.00237EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/24 1:12 p.m.13 views

CVE-2026-76847

act (nektos/act) versions 0.2.81 through 0.2.89 are affected by a missing authorization flaw in the Artifacts V4 backend , which is started whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. Three compounding issues enable unauthenticated artifact access: (1) val...

8.8CVSS5.3AI score
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/24 1:09 p.m.23 views

CVE-2026-78372 RansomLook Missing Authorization Allows Disclosure of Private Group and Ransom Note Data

RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with private entities through several web views and API endpoints. The...

9.2CVSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/24 1:03 p.m.6 views

EUVD-2026-64843

RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to remain private. The /export/ endpoint permits selected internal databases to be exported without requiring authentication. While...

9.2CVSS5.7AI score
SaveExploits0References1
Sick AG
Sick AG
added 2026/08/24 1:00 p.m.7 views

AppEngine vulnerability affects SICK ICR890-4 and SICK InspectorP6xx devices

Multiple internal virtual filesystem paths are unintentionally accessible remotely in the SICK ICR890-4 and SICK InspectorP6xx devices. If exploited, this vulnerability could potentially allow an unauthenticated attacker to compromise the availability, integrity, and confidentiality of the device...

9.4CVSS5.4AI score0.00488EPSS
SaveExploits0
CVE
CVE
added 2026/08/24 12:58 p.m.11 views

CVE-2026-78369

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. Although this endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attac...

8.8CVSS5.5AI score
SaveExploits0References1
Rows per page
Query Builder