118049 matches found
CVE-2026-28181
Subscriber Broken Access Control in AcyMailing SMTP Newsletter = 10.11.1 versions...
CVE-2026-66455
Subscriber Broken Access Control in ReactPress = 3.4.0 versions...
CVE-2026-66432
Subscriber Sensitive Data Exposure in WPJAM Basic = 7.0.2.1 versions...
CVE-2026-28181
CVE-2026-28181 concerns the WordPress AcyMailing SMTP Newsletter plugin, affected in versions up to 10.11.1. The issue is described as a Broken Access Control vulnerability, enabling unauthorized access to certain resources due to insufficient access restrictions. Based on the provided metrics, t...
EUVD-2026-57952
Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...
.NET: .NET Information Disclosure Vulnerability
Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network...
.NET: .NET Denial of Service Vulnerability
Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network...
.NET: .NET Information Disclosure Vulnerability
Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network...
CVE-2025-52640 HCL AION is affected by multiple security vulnerabilities.
HCL AION is affected by a vulnerability where the shared storage used by product components is architected without sufficient access separation. Processes sharing the storage may be able to access or modify files beyond their intended scope, potentially resulting in unintended behavior or securit...
RLSA-2026:54178 Moderate: grafana security, bug fix, and enhancement update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: grafana: Grafana: Privilege escalation via dashboard overwrite CVE-2026-33377 grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default...
CVE-2026-73607
SiYuan: Information disclosure vulnerability in /api/storage/getOutlineStorage on versions before v3.7.4 allows retrieving outline state (including heading IDs) for any document without authorization. This affects confidentiality; upgrade to v3.7.4+ (the fix) or apply vendor advisories. Per sourc...
CVE-2026-73488
Flowise CVE-2026-73488: An insecure direct object reference (IDOR) vulnerability in Flowise before 3.1.3 affects the GET /api/v1/organization/customer-default-source endpoint. Authenticated attackers can manipulate the customerId parameter to enumerate predictable customer IDs and access other cu...
Kibana 8.19.20, and 9.4.5 Security Update (ESA-2026-96)
Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-...
Kibana 8.19.20, and 9.4.5 Security Update (ESA-2026-95)
Missing Authorization in Kibana Leading to Unauthorized Execution of Endpoint Response Actions Missing Authorization CWE-862 in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A...
Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-110)
Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-915 in the case management functionality of Elastic Security in Kibana can lead to...
CVE-2026-59499
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor...
WordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by rajukani100 in WordPress Plugin InstaWP Connect versions = 0.1.3.7...
CVE-2026-59507 Priority – CWE-798: Use of Hard-coded Credentials CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control
CWE-798: Use of Hard-coded Credentials CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control...