Tagged “cve.org”
CVEs tagged cve.org, newest first.
46499 CVEsRSS
CVE-2026-116244High· 8.2PoCpgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials
When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME from its environment, so the Kerberos library fell back to the default credential cache, or a client keytab, of the oper…
CVE-2026-116242High· 8.2pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity
pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file, so it always loaded the unencrypted private keys in ~/.ssh of the operating-system account running pgAdmin, read that a…
CVE-2026-116238High· 8.1pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks
In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal accoun…
CVE-2026-116240Medium· 6.5pgAdmin 4: File Manager and storage-path tools act on a different path from the one checked
In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), which builds the absolute path with get_abs_path(). Several callers then acted on a path they built differently, so the path chec…
CVE-2026-116239High· 8.5pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username
In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an internal account and an LDAP account. After LDAP or Kerberos authenticated a user, pgAdmin chose the account to log i…
CVE-2026-61694Low· 3.7PoCgo-xrpl: ParseMPTAmountBinary: positive MPT amount silently decoded as negative (int64 wrap)
go-xrpl is a Go implementation of the XRP Ledger protocol. In versions through the June 18, 2026 revision identified by the advisory, `ParseMPTAmountBinary` in `internal/ledger/state/ripple_state.go` converts the eight-byte MPT magnitude…
CVE-2026-55598Critical· 9.1PoCPinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation)
PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through `POST /api/data/add_podcast` in `rust-api/src/handlers/podcasts…
CVE-2026-7005Medium· 6.1PoCWIT SynApps Runtime 1.4.11 Browser-Mediated SSRF via Controller Onboarding
WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue dis…
CVE-2026-114572Medium· 5.4Domain Login Restrict - Moderately critical - Access bypass - SA-CONTRIB-2026-249
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentication Bypass. This issue affects Domain Login Restrict versions: from 0.0.0 to 1.5.0.
CVE-2026-119328Medium· 6.5PoCImmich: Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service
Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machine-learning /predict endpoint in machine-learning/immich_ml/main.py accepted an options object and passed its values i…
CVE-2026-120007Medium· 6.5NodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uid
NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/comp…
CVE-2026-107251Medium· 6.5Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194
Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3.
CVE-2026-107252Medium· 5.4MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS). This issue affects MathJax: LaTeX for Drupal versions: from 0.0.0 t…
CVE-2026-107249Critical· 9.8Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.
CVE-2026-62301High· 7.1PoCMyTube: Visitor Can Access Hidden Video Metadata and Content
MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access does not enforce the visitor role's intended public-only restriction when `loginEnabled=true` and a visitor password …
CVE-2026-119763Medium· 5.3PoCchangelog.com before commit 7b35e829 Missing Authorization via Preview Routes
changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController. Attac…
CVE-2026-73322Medium· 6.5Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup()
Incorrect Authorization vulnerability in the single-stage query engine of Apache Pinot. When broker access control is enabled, the single-stage query engine authorizes only the table named in the query's FROM clause. The lookup() transf…
CVE-2026-118992High· 8.4CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup
CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup. restoreConfigBlob() feeds the database dump in a backup to the sqlite3 command-line shell. The shell r…
CVE-2026-52710Medium· 5.3WordPress GIFTiT – Free Gifts for WooCommerce plugin <= 4.5 - Content Injection vulnerability
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT – Free Gifts for WooCommerce ithemeland-free-gifts-for-woo allows Code Injection.This issue affects GIFTiT – F…
CVE-2026-39732Critical· 9.3PoCWordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerability
Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.
CVE-2026-62057Medium· 5.3WordPress Divi Contact Form 7 plugin <= 4.1.0 - Content Injection vulnerability
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Fahim Reza Divi Contact Form 7 cf7-styler-for-divi allows Code Injection.This issue affects Divi Contact Form 7: from n/a through 4.1.0.
CVE-2026-54855High· 7.1WordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.
CVE-2026-119526Critical· 9.8WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0.
CVE-2026-39786High· 7.1WordPress BA Book Everything plugin <= 1.8.33 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.
CVE-2026-27061Medium· 6.5WordPress User Registration plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions.
CVE-2026-54854Medium· 6.3WordPress Profile Builder plugin <= 4.0.5 - Privilege Escalation vulnerability
Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions.
CVE-2026-39734High· 7.5WordPress WP EasyPay plugin <= 4.5.4 - Path Traversal vulnerability
Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.
CVE-2026-90888Critical· 9.8WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.
CVE-2026-54850Medium· 6.5WordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions.
CVE-2026-73186High· 8.8WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.