🚨 CVE-2026-27410
Unauthenticated Deserialization of untrusted data in Slimstat Analytics < 5.4.0 versions.
🎖@cveNotify
Unauthenticated Deserialization of untrusted data in Slimstat Analytics < 5.4.0 versions.
🎖@cveNotify
Patchstack
Deserialization of untrusted data in WordPress Slimstat Analytics Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-32966
DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler.
This issue affects Apache DolphinScheduler: before 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes the issue.
🎖@cveNotify
DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler.
This issue affects Apache DolphinScheduler: before 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes the issue.
🎖@cveNotify
🚨 CVE-2026-32967
Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler.
This issue affects Apache DolphinScheduler: before 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes the issue.
🎖@cveNotify
Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler.
This issue affects Apache DolphinScheduler: before 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes the issue.
🎖@cveNotify
🚨 CVE-2026-34888
Unauthenticated Sensitive Data Exposure in Bricksforge <= 3.1.8.4 versions.
🎖@cveNotify
Unauthenticated Sensitive Data Exposure in Bricksforge <= 3.1.8.4 versions.
🎖@cveNotify
Patchstack
Sensitive Data Exposure in WordPress Bricksforge Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-40765
Unauthenticated Cross Site Scripting (XSS) in collectchat <= 2.4.9 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in collectchat <= 2.4.9 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress collectchat Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-40768
Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system <= 10.30.24 versions.
🎖@cveNotify
Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system <= 10.30.24 versions.
🎖@cveNotify
Patchstack
Insecure Direct Object References (IDOR) in WordPress Salon booking system Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-42357
Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.
This issue affects Apache DolphinScheduler versions prior to 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes this issue.
🎖@cveNotify
Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.
This issue affects Apache DolphinScheduler versions prior to 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes this issue.
🎖@cveNotify
🚨 CVE-2026-42629
Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions.
🎖@cveNotify
Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions.
🎖@cveNotify
Patchstack
Broken Authentication in WordPress PowerPack Pro for Elementor Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-45436
Subscriber Broken Access Control in WPBakery Page Builder <= 8.7.2 versions.
🎖@cveNotify
Subscriber Broken Access Control in WPBakery Page Builder <= 8.7.2 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress WPBakery Page Builder Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-47340
Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler.
This issue affects Apache DolphinScheduler: before 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes the issue.
🎖@cveNotify
Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler.
This issue affects Apache DolphinScheduler: before 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes the issue.
🎖@cveNotify
🚨 CVE-2026-48616
Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in Livechat files. Protected file downloads at /file-upload/:fileId/:name authorize livechat access using rc_room_type=l with rc_rid+rc_token, but the authorization path does not verify that rc_rid matches the requested file's rid. Furthermore, :fileId is predictable via sequential MongoDB IDs, and :name can be anything, allowing unauthenticated discovery of all uploaded files.
🎖@cveNotify
Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in Livechat files. Protected file downloads at /file-upload/:fileId/:name authorize livechat access using rc_room_type=l with rc_rid+rc_token, but the authorization path does not verify that rc_rid matches the requested file's rid. Furthermore, :fileId is predictable via sequential MongoDB IDs, and :name can be anything, allowing unauthenticated discovery of all uploaded files.
🎖@cveNotify
GitHub
fix: imported fixes 06-11-26 by julio-rocketchat · Pull Request #40889 · RocketChat/Rocket.Chat
Proposed changes (including videos or screenshots)
All approvals have already been given in the private fork.
Issue(s)
VLN-297, VLN-386, VLN-406, VLN-400
Steps to test or reproduce
N/A
Further comm...
All approvals have already been given in the private fork.
Issue(s)
VLN-297, VLN-386, VLN-406, VLN-400
Steps to test or reproduce
N/A
Further comm...