79067 matches found
CVE-2026-28071
CVE-2026-28071 concerns PixFort’s pixfort Core plugin, affecting versions
CVE-2026-27388 WordPress DesignThemes Booking Manager plugin <= 2.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in designthemes DesignThemes Booking Manager designthemes-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes Booking Manager: from n/a through = 2.0...
CVE-2026-27388 WordPress DesignThemes Booking Manager plugin <= 2.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in designthemes DesignThemes Booking Manager designthemes-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes Booking Manager: from n/a through = 2.0...
CVE-2026-27396 WordPress Directory Pro plugin <= 2.5.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in e-plugins Directory Pro directory-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directory Pro: from n/a through = 2.5.6...
CVE-2026-27374
CVE-2026-27374 is a Missing Authorization (broken access control) vulnerability in the WordPress plugin up to version <= 3.1. The Red Hat and NVD records describe an access-control failure in vanquish WooCommerce Order Details that can be exploited due to misconfigured access levels. Connecte...
AVideo: Unauthenticated PHP session store exposed to host network via published memcached port
Summary The official docker-compose.yml publishes the memcached service on host port 11211 0.0.0.0:11211 with no authentication, while the Dockerfile configures PHP to store all user sessions in that memcached instance. An attacker who can reach port 11211 can read, modify, or flush session data ...
EUVD-2025-208295
Suprema’s BioStar 2 in version 2.9.11.6 allows users to set new password without providing the current one. Exploiting this flaw combined with other vulnerabilities can lead to unauthorized account access and potential system compromise...
Directory Traversal
Overview @backstage/integration is a Helpers for managing integrations towards external systems Affected versions of this package are vulnerable to Directory Traversal via the SCM URL parsing. An attacker can access unauthorized SCM provider API endpoints by supplying specially crafted SCM URLs...
WordPress plugin Easy Post Submission 安全漏洞
WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. A security vulnerability exists in the WordPress plugin Easy Post Submission, which stems from ...
ZimaOS 安全漏洞
ZimaOS is an open-source operating system project by IceWhaleTech, aimed at providing a lightweight, high-performance, and secure operating system environment. Version ZimaOS 1.5.2-beta3 contains a security vulnerability, which stems from insufficient validation of API path parameters. This...
RustDesk 安全漏洞
RustDesk is a remote access and control software developed by RustDesk personal developers. It is primarily written in Rust and allows for remote maintenance of computers and other devices. Versions of RustDesk 1.7.5 and earlier, as well as 1.1.15 and earlier, have security vulnerabilities. These...
OpenClaw 安全漏洞
OpenClaw is an open-source intelligent artificial assistant. Versions of OpenClaw prior to 2026.2.6 contained security vulnerabilities. These vulnerabilities stemmed from a flaw in permission list validation, which allowed equal matches for the variable actor.name field. This could allow attacker...
PT-2026-23480
OpenProject is an open-source, web-based project management software. Prior to versions 17.0.5 and 17.1.2, an attacker can create wiki pages belonging to unpermitted projects through an improperly authenticated request. This issue has been patched in versions 17.0.5 and 17.1.2...
PT-2026-23581
Name of the Vulnerable Software and Affected Versions Versions affected versions not specified Description The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This results in predictable...
EC-CUBE 安全漏洞
EC-CUBE is an open-source e-commerce system developed by the Japanese company EC-CUBE. There is a security vulnerability in EC-CUBE, which stems from the possibility of bypassing multi-factor authentication. This vulnerability could allow attackers to access the management page without being...
WordPress plugin WeDesignTech Ultimate Booking Addon 安全漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...
WordPress plugin DesignThemes Directory Addon 安全漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be added t...
Keycloak 安全漏洞
Keycloak is an open-source identity and access management solution developed by Keycloak. Keycloak has a security vulnerability, which stems from the fact that disabled SAML clients can still complete the login process. This could allow remote attackers to gain unauthorized access to other enable...
WordPress plugin Site Suggest 安全漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...
Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this...