472889 matches found
PT-2026-106032
Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a...
CVE-2026-95263
Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-update permission can change the password of the built-in super administrator account. The server does not enforce protection for this account, and the update scenario does not...
CVE-2026-95263
Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-update permission can change the password of the built-in super administrator account. The server does not enforce protection for this account, and the update scenario does not...
CVE-2026-95263
Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control (CWE-284). A low-privilege backend administrator possessing administrator-update permissions can modify the password of the built-in super administrator account. This is possible because the server fails to enforce protections for the supe...
PT-2026-106021
Plane is an open-source project management tool. Prior to 1.4.0, a Project Member with role 15 can send a PATCH request to the project-member update endpoint at /api/workspaces/workspace slug/projects/project id/members/member pk/ to change another user's project role. The role-update logic block...
CVE-2026-104964: Authorization Bypass Through User-Controlled Key
Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a...
EUVD-2026-92783
Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-update permission can change the password of the built-in super administrator account. The server does not enforce protection for this account, and the update scenario does not...
PT-2026-106224
Name of the Vulnerable Software and Affected Versions Feehi CMS version 2.1.1 Description Incorrect Access Control allows a low-privilege backend administrator with administrator-update permission to change the password of the built-in super administrator account. This occurs because the server...
PT-2026-106043
Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL CLIENTS permission to update the server metadata. Server metadata is often used to store site wide configuration data that should only be updated by the server...
PT-2026-106000
LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update questio...
PT-2026-104669
GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic...
CVE-2026-105295: Download of Code Without Integrity Check
GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic...
OpenSSL Buffer Overflow
The vulnerability of the buffers in CipherCtxRef::cipherupdate, CipherCtxRef::cipherupdatevec, and symm::Crypter::update functions in the OpenSSL library for the Rust programming language is related to buffer overflows in the dynamic memory. Exploiting this vulnerability could allow an attacker t...
VMWare Workspace ONE UEM - Server-Side Request Forgery
VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain a server-side request forgery vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without...
CLSA-2026-1791060595 TuxCare security update for @angular (1 CVE)
TuxCare rebuilt 16 @angular packages to address 1 CVE. Fixed in 14.2.12-tuxcare.6...
CLSA-2026-1791059780 TuxCare security update for @angular (1 CVE)
TuxCare rebuilt 16 @angular packages to address 1 CVE. Fixed in 15.2.9-tuxcare.7...
CLSA-2026-1791054432 TuxCare security update for @angular (1 CVE)
TuxCare rebuilt 16 @angular packages to address 1 CVE. Fixed in 13.3.0-tuxcare.7...
CLSA-2026-1791053637 TuxCare security update for @angular (1 CVE)
TuxCare rebuilt 16 @angular packages to address 1 CVE. Fixed in 12.2.0-tuxcare.7...