| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-19907 | 9.8 | The Shipo plugin for WordPress is vulnerable to Authentication Bypass in versions 1.6 through 1.8.0. This is due to the `authenticate_rest_user()` function parsing the `LOGGED_IN_COOKIE` value and authenticating the named user without verifying the c | 2026-11-14 13:17:23 | 2026-11-14 13:17:23 |
| CVE-2026-18053 | 8.8 | The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7. This is due to a mass-assignment vulnerability in the `user_account_manager()` function's edit_profile branch, where all submitted | 2026-11-14 13:17:23 | 2026-11-14 13:17:22 |
| CVE-2026-129433 | 9.9 | Dokploy before 0.31.1 contains an OS command injection vulnerability in getComposeContainerCommand() that allows authenticated organization members to execute shell commands via the serviceName parameter. Attackers can store serviceName values with s | 2026-11-14 13:17:22 | 2026-11-14 13:17:22 |
| CVE-2026-129432 | 6.5 | Ettercap through 0.8.5.1 contains a heap out-of-bounds read vulnerability in dissector_mountd() in src/dissectors/ec_mountd.c that validates RPC credential and directory lengths independently rather than against the packet end. Network-adjacent attac | 2026-11-14 13:17:22 | 2026-11-14 13:17:22 |
| CVE-2026-129431 | 6.5 | Ettercap through 0.8.5.1 contains a heap out-of-bounds read vulnerability in dissector_socks() in src/dissectors/ec_socks.c that allows network-adjacent attackers to read heap memory via unchecked SOCKS5 username/password lengths. Attackers can send | 2026-11-14 13:17:22 | 2026-11-14 13:17:22 |
| CVE-2026-129430 | 5.4 | Axeloz Filesharing before 2.14.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script by storing raw HTML or javascript: Markdown links in bundle descriptions. Recipients viewing the public bundle prev | 2026-11-14 13:17:22 | 2026-11-14 13:17:22 |
| CVE-2026-129429 | 7.1 | Frappe india-payroll before 16.0.4 contains a missing authorization vulnerability in the get_employee_details, compute_tax_comparison and set_tax_regime methods of tax_regime_selector.py that allows authenticated low-privileged users to access other | 2026-11-14 13:17:22 | 2026-11-14 13:17:22 |
| CVE-2026-129428 | 5.4 | Pulse from 5.0.17 before 6.8.0 contains a missing authorization vulnerability in the /api/ai/approvals endpoints that allows authenticated viewer-level users to manage approval requests. Attackers can list pending requests to expose proposed commands | 2026-11-14 13:17:22 | 2026-11-14 13:17:22 |
| CVE-2026-129255 | 6.8 | A vulnerability was identified in CoolerMaster MASTERPLUS+ 1.9.6. This affects the function sub_11504 in the library WinRing0x64.sys of the component Device Driver. The manipulation of the argument PhysicalAddress leads to incorrect default permissio | 2026-11-14 13:17:22 | 2026-11-14 13:17:21 |
| CVE-2026-129254 | 5.0 | A flaw has been found in Opixido OCMS up to b7c15660aba83d96677c1a9abaa69c082a24f21c. This impacts an unknown function of the file admin/TUI/index.php of the component Admin TUI. This manipulation of the argument img causes cross site scripting. The | 2026-11-14 13:17:21 | 2026-11-14 13:17:21 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/40249
Zapisa po stranici: