79509 matches found
CVE-2026-25403
Affected software: WordPress plugin “Ultimate Store Kit Elementor Addons”
CVE-2026-58043
A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories. Mitigation Avoid enabling the Node.js Permission Model by not using the --permission flag when starting Node.js applications. This...
CVE-2026-15246 RealHomes Memberships < 3.1.0 - Subscriber+ Membership Payment Bypass
The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages...
Azure SQL Database Elevation of Privilege Vulnerability
Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network...
Microsoft Office SharePoint Spoofing Vulnerability
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-65551
Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7...
CVE-2026-16731
The CVE-2026-16731 entry affects OMICRON StationScout prior to version 3.05, where a cryptographic timing side-channel in the backend authentication enables an unauthenticated attacker to forge valid credentials and bypass authentication/authorization, effectively impersonating legitimate clients...
CVE-2026-16731 Authentication and authorization bypass via cryptographic timing side-channel attack in StationScout
OMICRON StationScout before version 3.05 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate...
CVE-2026-5430
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this...
CVE-2026-19010
A security vulnerability has been detected in TinyAGI 0.0.20. Impacted is the function processMessage of the file packages/main/src/index.ts of the component Message API Endpoint. Such manipulation leads to missing authorization. The attack can be launched remotely. The exploit has been disclosed...
CVE-2025-15039
The Conditional Authentication Adaptive Authentication script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges ...
CVE-2026-5430
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this...
CVE-2026-5430 Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this...
CVE-2026-5430
The CVE-2026-5430 issue is a JWT authentication bypass in WSO2 products, where tokens signed with unsupported algorithms are accepted due to improper validation. This allows an attacker to forge a JWT and gain unauthorized access, potentially compromising administrative accounts and enabling full...
CVE-2025-15039
The Conditional Authentication Adaptive Authentication script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges ...
CVE-2025-15039
CVE-2025-15039 concerns the Conditional Authentication (Adaptive Authentication) script in multiple WSO2 products. The flaw is that the script does not properly enforce completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configure...
EUVD-2025-210632
The Conditional Authentication Adaptive Authentication script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges ...
EUVD-2026-53820
When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values. A malicious actor with access to the 'wso2carbon' log files could retrieve sensiti...
CVE-2024-8995
Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these codes, enabling them to be potentially reused. If an attacker possesses both the authorization code and the associated client credentials clie...
CVE-2024-8995 Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access
Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these codes, enabling them to be potentially reused. If an attacker possesses both the authorization code and the associated client credentials clie...