Lucene search
+L

262703 matches found

NVD
NVD
added 4 days ago7 views

CVE-2026-15414

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the savemetaboxes function persisting the wpsplanuserrole membership plan meta from $POST without an allowlist that excludes privileged roles — the...

8.8CVSS0.00335EPSS
SaveExploits0References6
CVE
CVE
added 4 days ago12 views

CVE-2026-15414

CVE-2026-15414 affects the Subscriptions for WooCommerce plugin for WordPress, is_role(), both accepting administrator, and the UI’s disabled attribute is client-side-only, enabling bypass by POST or DevTools. Because wps_membership_plan is registered with capabilty_type => 'post', any user wh...

8.8CVSS5.5AI score0.00335EPSS
SaveExploits0References6
Cvelist
Cvelist
added 4 days ago37 views

CVE-2026-15414 Subscriptions for WooCommerce <= 2.0.0 - Authenticated (Contributor+) Privilege Escalation via '_wps_plan_user_role' Membership Plan Meta

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the savemetaboxes function persisting the wpsplanuserrole membership plan meta from $POST without an allowlist that excludes privileged roles — the...

8.8CVSS0.00335EPSS
SaveExploits0References6
EUVD
EUVD
added 4 days ago10 views

EUVD-2026-51680

Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

7.8CVSS6.2AI score0.00139EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 4 days ago9 views

PT-2026-67131

The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...

7.5CVSS5.6AI score0.00676EPSS
SaveExploits0References7
OSV
OSV
added 4 days ago6 views

PUB-A-493648935

In multiple functions of vpuioctl.c, there is a possible use after free due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

9.8CVSS6.9AI score
SaveExploits0References1
NVD
NVD
added 5 days ago8 views

CVE-2026-34641

Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

7.8CVSS0.00139EPSS
SaveExploits0References1
Cvelist
Cvelist
added 5 days ago38 views

CVE-2026-34641 Premiere Pro | Out-of-bounds Write (CWE-787)

Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

7.8CVSS0.00139EPSS
SaveExploits0References1
Cvelist
Cvelist
added 5 days ago39 views

CVE-2026-45376 Decidim: Admin user search allows SQL injection through similarity-based sorting

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params:term into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated...

5.5CVSS0.00341EPSS
SaveExploits0References7
OSV
OSV
added 5 days ago5 views

CVE-2026-45376 Decidim: Admin user search allows SQL injection through similarity-based sorting

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params:term into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated...

5.5CVSS5.6AI score
SaveExploits0References9
OSV
OSV
added 5 days ago5 views

CVE-2026-54768 WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This...

6.9CVSS5.5AI score
SaveExploits0References4
CVE
CVE
added 5 days ago16 views

CVE-2026-54768

WPGraphQL

6.9CVSS5.5AI score0.00278EPSS
SaveExploits0References2
EUVD
EUVD
added 5 days ago8 views

EUVD-2026-51676

WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This...

6.9CVSS5.5AI score0.00278EPSS
SaveExploits0References2
OSV
OSV
added 5 days ago4 views

GHSA-JHH7-832H-F8HV WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

Summary The sendPasswordResetEmail mutation in WPGraphQL is explicitly designed to prevent user enumeration. The resolver in src/Mutation/SendPasswordResetEmail.php states in a code comment: // We obsfucate the actual success of this mutation to prevent user enumeration. The mutation always retur...

6.9CVSS5.7AI score0.00278EPSS
SaveExploits0References3
Github Security Blog
Github Security Blog
added 5 days ago8 views

WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

Summary The sendPasswordResetEmail mutation in WPGraphQL is explicitly designed to prevent user enumeration. The resolver in src/Mutation/SendPasswordResetEmail.php states in a code comment: // We obsfucate the actual success of this mutation to prevent user enumeration. The mutation always retur...

6.9CVSS5.7AI score0.00278EPSS
SaveExploits0References3Affected Software1
Cvelist
Cvelist
added 5 days ago40 views

CVE-2026-65981 Coturn: MOBILITY-TICKET session-resume authorization bypass allows cross-user TURN allocation takeover

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with the resuming user's credentials but does not verify that identity against the original allocation owner, allowing an authenticated attacker...

7.1CVSS0.0025EPSS
SaveExploits0References2
OSV
OSV
added 5 days ago5 views

CVE-2026-65981 Coturn: MOBILITY-TICKET session-resume authorization bypass allows cross-user TURN allocation takeover

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with the resuming user's credentials but does not verify that identity against the original allocation owner, allowing an authenticated attacker...

7.1CVSS5.5AI score
SaveExploits0References4
CVE
CVE
added 5 days ago18 views

CVE-2026-65981

CVE-2026-65981 affects Coturn prior to 4.15.0. A MOBILITY-TICKET–based session-resume flaw allows an authenticated attacker to bypass per-allocation authorization: a resumed REFRESH is validated against the attacker’s identity instead of the original allocation owner, enabling cross-user receipt ...

7.1CVSS5.5AI score0.0025EPSS
SaveExploits0References2
NVD
NVD
added 5 days ago9 views

CVE-2026-53599

REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rexmediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with mediaupload permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with...

7.5CVSS0.00314EPSS
SaveExploits0References4
EUVD
EUVD
added 5 days ago16 views

EUVD-2026-44802

NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE...

10CVSS5.7AI score0.00593EPSS
SaveExploits1References5
Rows per page
Query Builder