147467 matches found
CVE-2026-97898
The Akia keyless entry cloud service contained an Insecure Direct Object Reference (IDOR) vulnerability due to missing object-level authorization. The unlock action failed to validate client-supplied room or door identifiers against the authenticated guest's specific booking on the server-side. T...
CVE-2026-88848
The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor that the plan identifier submitted with the request is one they actually hold, allowing any member to enrol themselves into restricted paid...
CVE-2026-79313
A flaw was found in webpy. The application's session management relies on periodic cleanup to expire sessions instead of checking the last-access time when a session is loaded. This allows an attacker holding a previously valid session cookie to replay and use an expired session. As a result, an...
CVE-2026-79017
A flaw was found in Chromium. A race condition in the Extensions component allows a remote attacker to bypass system access restrictions by using a specially crafted Chrome extension. This could lead to unauthorized access to system resources...
CVE-2026-79099
A flaw was found in Google Chrome's Network component. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This could allow the attacker to bypass system access restrictions, leading to unauthorized access or actions within the affected...
EUVD-2026-86627
The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor that the plan identifier submitted with the request is one they actually hold, allowing any member to enrol themselves into restricted paid...
Kibana 8.19.22, 9.4.6 Security Update (ESA-2026-103)
Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality...
CVE-2026-92609
Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended...
CVE-2026-89406
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the ModulaMeta::addmetas function being hooked to wphead on every frontend request and looking up...
CVE-2026-78974
A flaw was found in chromium-browser. This user interface UI misrepresentation vulnerability allows a remote attacker, through social engineering, to bypass system access restrictions by tricking a user into interacting with a specially crafted HTML page. This could lead to unauthorized access to...
CVE-2026-79152
A flaw was found in Google Chrome CustomTabs. A local attacker could exploit incorrect authorization to bypass the web origin policy through a co-installed application. This bypass could allow unauthorized access to web content...
EUVD-2026-86581
Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended...
CVE-2026-92609
Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended...
CVE-2026-92609
Apache Qpid Broker-J versions through 10.1.0 are vulnerable to a session fixation flaw in the HTTP management authentication. The root cause is the missing renewal of HTTP sessions after a successful authentication, which allows a remote attacker to reuse a session identifier to gain unauthorized...
CVE-2026-92609 Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication
Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended...
CVE-2026-92609 Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication
Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended...
CVE-2026-92609 Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication
Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended...
EUVD-2026-86602
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the ModulaMeta::addmetas function being hooked to wphead on every frontend request and looking up...
CVE-2026-89406 Modula Image Gallery <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' Parameters
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the ModulaMeta::addmetas function being hooked to wphead on every frontend request and looking up...
CVE-2026-89406 Modula Image Gallery <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' Parameters
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the ModulaMeta::addmetas function being hooked to wphead on every frontend request and looking up...