398400 matches found
CVE-2026-90904 Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0
Joomla Extension - joomshaper.com - Broken Access Control ACL Bypass in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level ACL permission checks. Any authenticated...
CVE-2026-90899 Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0
Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping details full...
CVE-2026-84486 Automation-controller: automation-controller-container: automation-controller: unauthenticated debug scheduler-trigger endpoints (allowany, routed without debug guard) allow advisory-lock starvation of job dispatch (dos)
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Four debug views that trigger the internal task, dependency, and workflow schedulers are configured to allow any user including unauthenticated clients and are routed in production builds because their URL include i...
CVE-2026-76087 Formie: Unauthenticated users can overwrite incomplete submissions via submit action
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a...
CVE-2026-90900 Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0
Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submission endpoint index.php?option=comeasystore&task=product.addReview accepted submissions without verifying an anti-CSRF token t...
CVE-2026-76086 Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a...
CVE-2026-96548 sfturing hosp_order jdbc.properties hard-coded credentials
A flaw has been found in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssmpro/src/main/resources/jdbc.properties. This manipulation causes hard-coded credentials. It is possible to initiate the attack remotely. The attack's complexity ...
CVE-2026-96546 Gimp: gimp: one-byte out-of-bounds heap read in the uncompressed dds loader
A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in performs an unconditional one-byte look-ahead after processing the final pixel. This may cause the plug-in to crash if the byte immediately...
CVE-2026-71465 Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection into ansible executable
RunAdHocCommand.buildargs appends limit as bare positional args.appendlimit instead of using args.extend'-l', limit like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags --version, --help since injected element displaces required patter...
CVE-2026-71464 Automation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm_branch prompt bypasses leading-dash git-argument guard
LaunchConfigurationBaseSerializer.scmbranch has no validatescmbranch leading-dash check, unlike Project/JobTemplate/JobLaunch serializers. Schedule and WFJT Node accept --upload-pack=/bin/id as scmbranch. Currently blocked at runtime by jobs.py:1502 ValueError check defense-in-depth, but the API...
CVE-2026-71463 Automation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via conditional gating leaks tracebacks
Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts job'job'+'env' and % if job.id 100 % conditional gating bypass both the AST check and the test-render stub has small job.id. At runtime, the gated branch executes and exceptions write full tracebacks...
CVE-2026-96545 Gimp: gimp: out-of-bounds heap read in the 4bpp tim image loader
An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents in...
CVE-2026-76089 Formie: Missing authorization on sent notification resend modal exposes submission PII
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level...
CVE-2026-71462 Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence oracle on control pod
StringListPathField.tointernalvalue calls os.path.exists on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRETKEY, k8s service-account token, receptor sockets, ConfigMap mount...
CVE-2026-82356 Imprivata EAM: Unrotatable X.509 RSA Key Pair in Production
Imprivata EAM =26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best practices...
CVE-2026-71461 Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handler
HostList.list catches bare Exception and returns stre verbatim. Via hostfilter, any authenticated user triggers Django FieldError leaking complete Host model relation graph including internal reverse accessors or PostgreSQL DataError leaking raw database error strings. Two primitives:...
CVE-2026-71460 Automation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license details via /config/
/api/v2/config/ is protected only by IsAuthenticated. licenseinfo accountnumber, subscriptionid, poolid, sku, supportlevel, instance counts returned to any authenticated user. The superuser/auditor gate only covers projectbasedir/projectlocalpaths/customvirtualenvs, not licenseinfo. Enables socia...
CVE-2026-76648 Automation-controller: automation-controller-container: aap controller: copyapiview.post() missing read authorization check enables job template secret recovery
CopyAPIView awx/awx/api/generics.py:873 sets permissionclasses = IsAuthenticated,, so DRF's getobject performs no object-level RBAC. The get handler lines 988–991 explicitly guards with request.user.canaccessobj.class, 'read', obj — but post lines 1001–1010 does not. POST only checks:...
CVE-2026-92692 Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that concatenates category identifiers from the...
CVE-2026-77423 JLine: ReDoS in Built-in Less Viewer Search
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPatternboolean doDisplayPattern in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's...
CVE-2026-95604 WordPress Loops & Logic plugin <= 4.2.4 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...
CVE-2026-95602 WordPress YITH WooCommerce Request A Quote plugin < 4.46.1 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1...
CVE-2026-95603 WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...
CVE-2026-95601 WordPress Product Filter by WBW plugin <= 3.1.7 - SQL Injection vulnerability
Unauthenticated SQL Injection in Product Filter by WBW = 3.1.7 versions...
CVE-2026-95600 WordPress TrustedLogin Connector plugin <= 2.0.3 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in TrustedLogin Connector = 2.0.3 versions...
CVE-2026-95592 WordPress Team plugin <= 6.0.0 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in Team = 6.0.0 versions...
CVE-2026-95593 WordPress Ultimeter plugin <= 3.0.8 - SQL Injection vulnerability
Editor SQL Injection in Ultimeter = 3.0.8 versions...
CVE-2026-95590 WordPress Tainacan plugin <= 1.2.0 - SQL Injection vulnerability
Subscriber SQL Injection in Tainacan = 1.2.0 versions...
CVE-2026-95586 WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 = 3.5.50 versions...
CVE-2026-95529 WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Calculated Fields Form = 5.5.1.1 versions...
CVE-2026-95530 WordPress PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 11.4.1 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting XSS in PixelYourSite – Your smart PIXEL TAG Manager = 11.4.1 versions...
CVE-2026-95528 WordPress Core Web Vitals & PageSpeed Booster plugin <= 1.0.31 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Core Web Vitals & PageSpeed Booster = 1.0.31 versions...
CVE-2026-95527 WordPress Conekta Payment Gateway plugin <= 6.2.4 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Conekta Payment Gateway = 6.2.4 versions...
CVE-2026-95525 WordPress WP User Frontend plugin <= 4.3.11 - Arbitrary File Deletion vulnerability
Subscriber Arbitrary File Deletion in WP User Frontend = 4.3.11 versions...
CVE-2026-95523 WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability
Subscriber Bypass Vulnerability in WP User Frontend = 4.3.11 versions...
CVE-2026-95524 WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in WP User Frontend = 4.3.11 versions...
CVE-2026-95522 WordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerability
Shop manager SQL Injection in Easy Digital Downloads = 3.7.0 versions...
CVE-2026-95515 WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Ninja Forms = 3.15.3 versions...
CVE-2026-95513 WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.6.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita = 4.6.0 versions...
CVE-2026-95514 WordPress Netgsm plugin <= 2.10.0 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in Netgsm = 2.10.0 versions...
CVE-2026-94684 WordPress Ocean Extra plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Ocean Extra = 2.6.1 versions...
CVE-2026-94680 WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in The Post Grid = 7.9.5 versions...
CVE-2026-94682 WordPress Podcast Importer SecondLine plugin <= 1.5.6 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Podcast Importer SecondLine = 1.5.6 versions...
CVE-2026-94679 WordPress Fluent Support plugin <= 2.3.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in Fluent Support = 2.3.2 versions...
CVE-2026-94671 WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in The Post Grid = 7.9.5 versions...
CVE-2026-94500 WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in ElementsKit Elementor addons Lite = 4.0.5 versions...
CVE-2026-94498 WordPress AppMySite plugin <= 3.15.4 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in AppMySite = 3.15.4 versions...
CVE-2026-94487 WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in PublishPress Capabilities = 2.50.1 versions...