300290 matches found
CVE-2026-86683: Improper Input Validation
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings...
CVE-2026-96443: Inclusion of Functionality from Untrusted Control Sphere
Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE...
PT-2026-97318
ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope...
PT-2026-97319
Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager versions 182000 and earlier Description A low-privileged user can modify the proxy settings of the application. Recommendations Update to a version later than 182000...
PT-2026-97194
The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or...
PT-2026-97516
Name of the Vulnerable Software and Affected Versions Easy Store versions 1.0.0 through 3.0.0 Description Broken Access Control ACL Bypass exists in the ApiController record editing functionality. The allowEdit function in ApiController.php contains a hardcoded return value of true, which bypasse...
CVE-2026-71461: Generation of Error Message Containing Sensitive Information
HostList.list catches bare Exception and returns stre verbatim. Via hostfilter, any authenticated user triggers Django FieldError leaking complete Host model relation graph including internal reverse accessors or PostgreSQL DataError leaking raw database error strings. Two primitives:...
CVE-2026-6730: Buffer Copy without Checking Size of Input
IBM Concert 1.0.0 through 3.0.0 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system...
CVE-2026-76089: Exposure of Sensitive Information to an Unauthorized Actor
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level...
PT-2026-97366
Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An administrative user can obtain sensitive information when the browser returns a detailed technical error message. This exposure of internal data could be leveraged to facilitate further...
PT-2026-97677
Name of the Vulnerable Software and Affected Versions Stop administrator login versions 1.0 through 1.6 Description The module fails to sufficiently enforce access restrictions across all supported authentication mechanisms. This allows a blocked administrative user to bypass authentication...
CVE-2026-96655: Server-Side Request Forgery (SSRF)
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...
CVE-2026-84789: Authorization Bypass Through User-Controlled Key
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope...
ROS-20260923-73-0056
The vulnerability of the floattoint function in the drivers/hid/amd-sfh-hid/sfh11/amdsfhdesc.c file of the Linux kernel subsystem for user interface devices’ driver lies in the handling of buffer overflows. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...
PT-2026-97339
Name of the Vulnerable Software and Affected Versions InvoiceShelf versions prior to 2.4.1 Description In multi-company installations, a user with Owner privileges in one company can read and overwrite any user account in any other company on the same installation. This occurs because the GET/PUT...
CVE-2026-62998: Improper Input Validation
REDAXO is a PHP-based content management system. Prior to 5.21.2, rexlist::getSortColumn in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable registered the requested column. An authenticated backend user can make prepareQuery add an escape...
PT-2026-97477
Subscriber Bypass Vulnerability in WP User Frontend = 4.3.11 versions...
PT-2026-97406
Name of the Vulnerable Software and Affected Versions Plex Media Server versions prior to 1.43.3.10861 Description An administrative user can write arbitrary files that may be executed upon loading. This occurs because the TranscoderH264Options preference is appended verbatim to the x264 option...
CVE-2026-95602: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1...