CVE-2026-97305 WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2...

EUVD-2026-92586

Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2...

CVE-2026-97070 WordPress Cozy Blocks plugin <= 2.2.23 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23...

CVE-2026-103085 WordPress WP User Manager plugin <= 2.9.20 - Privilege Escalation vulnerability

Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User Manager: from n/a through 2.9.20...

EUVD-2026-92582

Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User Manager: from n/a through 2.9.20...

CVE-2026-103085 WordPress WP User Manager plugin <= 2.9.20 - Privilege Escalation vulnerability

Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User Manager: from n/a through 2.9.20...

CVE-2026-103085

The WP User Manager plugin for WordPress (versions

CVE-2026-104961

Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceOwnerPermission does not require isactive=True when checking whether a user is a workspace owner. A deactivated user can therefore remain authorized as the workspace owner and retain owner-level access. This issue is fixed ...

EUVD-2026-92482

Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceOwnerPermission does not require isactive=True when checking whether a user is a workspace owner. A deactivated user can therefore remain authorized as the workspace owner and retain owner-level access. This issue is fixed ...

CVE-2026-88397

ApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter...

EUVD-2026-92472

Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension 6.6.0 - The Google Photos picker of the back-end upload page fetches the thumbnails of the picked images through the server, with the OAuth access token of the Google Photos...

CVE-2026-104890

Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php performs the blacklistedextensions check case-sensitively in FileHandler::getFilePath and lowercases the stored extension afterward. An...

CVE-2026-27771

CVE-2026-27771 — Gitea Container Registry Auth Bypass CVSS: N/A unpublished Affects: Gitea Disclaimer: This proof-of-concept is provided for educational and authorized security research purposes only. Unauthorized access to computer systems is illegal. The authors are not responsible for any misu...

WordPress Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin <= 1.5.9 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dzeusking in WordPress Plugin Newsletter Subscription Form – User Subscriptions Form, Capture Email versions = 1.5.9...

CVE-2026-79820

A remote user validation failure vulnerability exists in HPE Integrated Lights-Out iLO 7 firmware...

CVE-2026-79820

A remote user validation failure vulnerability exists in HPE Integrated Lights-Out iLO 7 firmware...

EUVD-2026-92433

A remote user validation failure vulnerability exists in HPE Integrated Lights-Out iLO 7 firmware...

CVE-2026-79820

A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware . This flaw allows for a potential CRITICAL impact on confidentiality, integrity, and availability. While the CVSS score indicates a high attack complexity and a changed scope, specific technical d...

CVE-2026-79820

A remote user validation failure vulnerability exists in HPE Integrated Lights-Out iLO 7 firmware...

Zeroshell kerbynet RCE (CVE-2019-12725)

Exploits CVE-2019-12725 in Zeroshell 3.9.0: newline injection in the User parameter of kerbynet StartSessionSubmit yields unauthenticated RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Zeroshell kerbynet command injection CVE-2019-12725.""" import re import urllib.parse from kittysploit import...