396044 matches found
CVE-2026-85218
CVE-2026-85218 is currently a reserved candidate with no publicly available technical details. The entry will be updated when the responsible organization publicizes the vulnerability. Action: monitor for updates .
CVE-2026-85396
rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract. The root cause is that extraction paths are validated using prefix comparison without trailing separators , allowing attackers to craft archive entries with names like ../upload_backup/owned.sh that bypass...
CVE-2026-85395
UnoPim before 2.1.3 is affected by a missing authorization vulnerability in the Bouncer middleware . The integration store, update, and key-generation routes were omitted from the ACL map, allowing any user with minimal admin privileges to bypass permission checks. An attacker can create OAuth AP...
CVE-2026-85394
python-jose through version 3.5.0 contains an algorithm confusion vulnerability in its HMAC key validation logic. The library fails to properly reject DER-encoded public keys that lack PEM armor or SSH prefixes, allowing them to be accepted as HMAC secrets. An attacker who possesses the service's...
CVE-2026-85393
node-forge through 1.4.0 has a cryptographic vulnerability in its RSA PKCS#1 v1.5 signature verification . The library fails to validate the element count in nested DigestAlgorithm sequences, allowing an attacker to embed garbage bytes inside that sequence to forge valid signatures for arbitrary ...
CVE-2026-85392
Peppermint (through version 0.5.5) contains an authorization bypass in the GET /api/v1/auth/user/:id/logout API endpoint. The endpoint performs no check to verify the caller owns the target account, allowing any authenticated attacker to supply an arbitrary user ID and forcibly delete that user's...
CVE-2026-85391
Peppermint through version 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml, also referenced in apps/api/src/lib/jwt.ts. This allows unauthenticated attackers to forge session tokens for arbitrary user IDs and access protected endpoints without valid credentials. The vulnerabil...
CVE-2026-85390
Checkmate through 3.11.0 omits the isAllowed role guard middleware on its maintenance-window, notification, and check-deletion routes, allowing users with a read-only role to perform administrative actions. A low-privileged attacker with a valid user-role session can create arbitrary maintenance ...
CVE-2026-85389
Worklenz before 3.0.0 suffers from an authorization bypass on task-scoped API endpoints due to missing verification of task ownership by organization. Authenticated users can query task endpoints with arbitrary task UUIDs to retrieve work logs, comments, attachments, and project insights belongin...
CVE-2026-85388
Worklenz through 3.0.0 is vulnerable to blind SQL injection via the sort-field query parameter in pagination helper functions. The root cause is improper validation that allows authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can leverage time-based ...
CVE-2026-33630
c-ares , an asynchronous DNS resolver library, is affected by a use-after-free / double-free in its query-completion handling, present from version 1.32.3 through 1.34.6 and fixed in 1.34.7 . The flaw occurs when a query's callback is invoked while the query is still linked in the channel's inter...
CVE-2026-82302
CVE-2026-82302 is an Incorrect Authorization (CWE-863) vulnerability in Kibana that allows an attacker with low privileges to modify configurations without proper authorization, via exploiting incorrectly configured access control security levels (CAPEC-180). The CVSS 3.1 score is 8.1 (HIGH) , wi...
CVE-2026-82299
CVE-2026-82299 is an Incorrect Authorization (CWE-863) vulnerability in Kibana that can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). The CVSS 3.1 score is 6.5 (MEDIUM) , with a network attack vector, low complexity, low privilege...
CVE-2026-82298
Kibana (Elastic) is affected by an Incorrect Authorization flaw (CWE-863) that can lead to denial of service when access control security levels are incorrectly configured (CAPEC-180). The CVSS 3.1 score is 4.3 (MEDIUM) with a network vector, low complexity, low privileges required, and low avail...
CVE-2026-78596
Kibana (versions 8.19.2, 9.4.6, 9.5.3 ) is affected by a Missing Authorization flaw (CWE-862) in Entity Analytics migration operations . An authenticated user holding only Security read-level access in a single Kibana space can trigger these migration operations, which perform privileged writes a...
CVE-2026-78595
CVE-2026-78595 is a Missing Authorization (CWE-862) vulnerability in the Kibana Fleet feature that enables cross-space information disclosure. An authenticated user with only read-level Fleet agent privileges in one Kibana space can enumerate agent metadata and access diagnostic content belonging...
CVE-2026-78593
Kibana 's Cribl integration contains an insufficiently validated configuration field that allows an authenticated user with Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template. This results in an Elasticsearch ingest pipeline being writt...
CVE-2026-78583
CVE-2026-78583 is an Incorrect Authorization (CWE-863) vulnerability in Kibana 's Elastic Fleet feature. Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents . An attacker holding Fl...
CVE-2026-15431
HP Support Assistant versions prior to 9.53.2.0 contain a local privilege escalation vulnerability caused by insufficient access controls , allowing a local attacker with low privileges (and no user interaction) to compromise the confidentiality, integrity, and availability of the vulnerable syst...
CVE-2026-67399
CVE-2026-67399 is currently a reserved candidate with no public technical details. Affected products, root cause, and impact are not yet disclosed. Monitor for updates once the assigning organization publicizes the vulnerability.
CVE-2026-49456
Waku (the minimal React framework) prior to version 1.0.0-beta.1 is vulnerable to an open redirect via the unstable_redirect() helper in waku/router/server. The function reflects user-supplied strings unchanged into the HTTP Location header with no URL validation, scheme restriction, or path-only...
CVE-2026-49455
Waku (a minimal React framework, npm package) prior to 1.0.0-beta.1 is vulnerable to cross-origin CSRF on its RSC server action dispatch. The root cause is the absence of any Origin or Sec-Fetch-Site validation in the RSC dispatch branch of request.ts, allowing a cross-origin attacker to invoke a...
CVE-2026-82526
R2R (SciPhi-AI) through 3.6.6 contains a stacked SQL injection in the vector index creation endpoint. The index name parameter is interpolated directly into a CREATE INDEX statement via string formatting without identifier quoting or allowlist validation, allowing unauthenticated attackers to exe...
CVE-2026-85028
CVE-2026-85028 affects the FPGA management tool installation component of AWS FPGA Development Kit (aws-fpga) prior to version 2.3.4 . The root cause is the creation of a temporary file in a world-writable directory with insecure permissions. A local attacker with low privileges can place crafted...
CVE-2026-82024
The LearnPress WordPress Plugin (before 4.4.6 ) contains a stored XSS vulnerability. Authenticated users with the Instructor role can inject arbitrary JavaScript by submitting unsanitized input into quiz question answer title fields , which is rendered through an unescaped HTML sink . The payload...
CVE-2026-82023
LearnPress WordPress Plugin versions before 4.4.6 are affected by a broken object-level authorization (BOLA) vulnerability in the question answer insert code path. The root cause is a missing ownership check that fails to verify whether the question belongs to the authenticated user. An attacker ...
CVE-2026-83959
Substance3D - Sampler (Adobe) is affected by a Heap-based Buffer Overflow (CWE-122) that can lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction —a victim must open a malicious file. The CVSS 3.1 base score is 7.8 (HIGH) with a local attack ...
CVE-2026-85187
itsourcecode Online Medicine Delivery System 1.0 is affected by an SQL injection vulnerability in the Order::pupdate function within the file /rider/orders/controller.php?action=edit&actions=confirm (component: Order Status Update). The vulnerability is triggered by manipulating the ID argument, ...
CVE-2026-63219
CVE-2026-63219 (CVSS 8.6) is a missing authorization check on the GeoNetwork formatter upload API endpoint, affecting versions prior to 4.4.12 and 4.2.17 . An unauthenticated attacker can upload arbitrary .xsl or .zip files into the server formatter directory, granting unauthorized write access. ...
CVE-2026-85012
AWS codecatalyst-blueprints (the blueprint resynthesis framework in the npm package) before version 0.3.156 is vulnerable to OS command injection (CWE-78). A user with permission to commit to a project repository can execute arbitrary commands in the resynthesis environment by embedding shell met...
CVE-2026-58400
GeoNetwork is an open-source geospatial metadata catalog (originated at the UN FAO, maintained under OSGeo). In versions prior to 4.4.12 and 4.2.17 , the Saxon XSLT processor used to render formatters lacks FEATURE_SECURE_PROCESSING and does not disable ALLOW_EXTERNAL_FUNCTIONS, allowing any load...
CVE-2026-84968
An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver can be triggered by an unauthenticated party supplying specially crafted input containing corrupt nested BSON in a field path. This causes a small amount of adjacent process memory to be copied into an error message re...
CVE-2026-85186
itsourcecode Online Medicine Delivery System 1.0 is affected by an unrestricted file upload vulnerability in the Customer Controller component, specifically the doupdateimage function in /customer/controller.php?action=photos. An attacker can manipulate the photo argument to upload arbitrary file...
CVE-2026-85304
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) , a WordPress plugin, has a Missing Authorization (broken access control) vulnerability in versions through 2.0.17 . The flaw allows exploitation of incorrectly configured access control security levels, resulting in low confident...
CVE-2026-85309
CVE-2026-85309 is a Missing Authorization (Broken Access Control) vulnerability in the Ultimate Maps by Supsystic WordPress plugin, affecting versions from unspecified through 1.5.3 . Unauthenticated attackers can exploit incorrectly configured access control security levels over the network with...
CVE-2026-85308
Brainstorm Force SureForms , a WordPress plugin, is affected by an Authorization Bypass Through User-Controlled Key (IDOR) vulnerability in versions from n/a through 2.12.5 . The flaw allows exploitation of incorrectly configured access control security levels, meaning an unauthenticated remote a...
CVE-2026-85307
KP Agent Ready is a WordPress plugin developed by Kevin Pirnie. Versions prior to 1.2.08 are affected by an Insertion of Sensitive Information Into Sent Data vulnerability that allows an unauthenticated remote attacker to retrieve embedded sensitive data. The CVSS v3.1 score is 5.3 (Medium) with ...
CVE-2026-75602
OpenList (a file list program supporting multiple storage backends) versions prior to 4.2.3 are affected by an authenticated path traversal vulnerability in the offline-download feature. When the SimpleHttp tool is used via POST /api/fs/add_offline_download, an attacker-controlled Content-Disposi...
CVE-2026-85306
MountDev AI MCP Connector for WordPress , a plugin by Cascadia Web Services, is affected by a Missing Authorization (Broken Access Control) vulnerability in versions from unspecified up to 1.6.5 . The flaw allows exploitation of incorrectly configured access control security levels, granting a lo...
CVE-2026-85305
A Server-Side Request Forgery (SSRF) vulnerability affects the SEOPress WordPress plugin in versions from n/a through 10.1 . The flaw allows an attacker to force the server to make unintended requests. The CVSS v3.1 score is 5.4 (MEDIUM) , with a network vector, low complexity, low privileges req...
CVE-2026-85303
CVE-2026-85303 affects the Booking and Rental Manager WordPress plugin by Magepeople inc. , with a Stored XSS vulnerability present in versions from unspecified through 2.7.7 . The flaw stems from improper neutralization of input during web page generation, allowing an attacker with low privilege...
CVE-2026-85302
A DOM-Based XSS vulnerability exists in the WPKoi Templates for Elementor WordPress plugin, affecting versions from n/a through 3.7.2 . The flaw stems from improper neutralization of input during web page generation. Exploitation requires low privileges and user interaction , with a changed scope...
CVE-2026-84848
The WordPress Quick Event Manager plugin (versions
CVE-2026-84847
CVE-2026-84847 affects the WordPress Quick Event Manager plugin in versions 9.17 and earlier . The vulnerability is an unauthenticated Broken Access Control flaw, meaning an attacker with no prior access can exploit it over the network with low complexity and no user interaction. The CVSS 3.1 sco...
CVE-2026-84836
WC Ukraine Shipping is a WordPress plugin affected by an Insecure Direct Object References (IDOR) vulnerability in versions 1.22.3 and earlier . The flaw allows a low-privilege user (Subscriber level) to access restricted objects, resulting in high confidentiality impact and low integrity impact,...
CVE-2026-84834
CVE-2026-84834 affects the WordPress JobSearch plugin in versions ≤ 3.2.0 . The vulnerability is an unauthenticated PHP Object Injection , allowing a remote attacker with no privileges to potentially achieve high impact on confidentiality, integrity, and availability, as reflected by a CVSS 3.1 s...
CVE-2026-84814
CVE-2026-84814 affects the WordPress Bricksforge plugin in versions 3.1.8.8 and below , introducing a Subscriber Privilege Escalation vulnerability. According to the PatchStack CVSS 3.1 assessment, the vulnerability is rated CRITICAL (9.8) with a network attack vector, low complexity, no required...
CVE-2026-84813
An unauthenticated SQL Injection vulnerability affects the WordPress GeoDirectory plugin in versions