🚨 CVE-2026-66585
Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions.
🎖@cveNotify
Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions.
🎖@cveNotify
Patchstack
Sensitive Data Exposure in WordPress WP Cafe Pro Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-78272
Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.
🎖@cveNotify
Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress Fluent Support Pro Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-78277
Subscriber Server Side Request Forgery (SSRF) in FluentCRM Pro <= 3.1.12 versions.
🎖@cveNotify
Subscriber Server Side Request Forgery (SSRF) in FluentCRM Pro <= 3.1.12 versions.
🎖@cveNotify
Patchstack
Server Side Request Forgery (SSRF) in WordPress FluentCRM Pro Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-78278
Subscriber Insecure Direct Object References (IDOR) in Fluent Boards Pro <= 2.0.11 versions.
🎖@cveNotify
Subscriber Insecure Direct Object References (IDOR) in Fluent Boards Pro <= 2.0.11 versions.
🎖@cveNotify
Patchstack
Insecure Direct Object References (IDOR) in WordPress Fluent Boards Pro Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-78279
Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions.
🎖@cveNotify
Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions.
🎖@cveNotify
Patchstack
Cross Site Request Forgery (CSRF) in WordPress Fluent Support Pro Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-78280
Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions.
🎖@cveNotify
Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions.
🎖@cveNotify
Patchstack
Cross Site Request Forgery (CSRF) in WordPress Hash Form Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-78290
Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.
🎖@cveNotify
Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Magazine Blocks Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-21756
HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environments.
🎖@cveNotify
HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environments.
🎖@cveNotify
🚨 CVE-2026-21759
HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly. Although no sensitive information (e.g., credentials, PII) was discovered, exposing API documentation to unauthenticated users can increase the overall attack surface.
🎖@cveNotify
HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly. Although no sensitive information (e.g., credentials, PII) was discovered, exposing API documentation to unauthenticated users can increase the overall attack surface.
🎖@cveNotify
🚨 CVE-2026-78365
Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/{id} setting company_id in the body.
🎖@cveNotify
Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/{id} setting company_id in the body.
🎖@cveNotify
GitHub
fix(api): prevent tenant hijacking via mass assignment in SupplierUpd… · Roskus/prospero-flow-crm@4a52477
…ateController
- Added company_id scoping to prevent cross-company supplier modification.
- Replaced $request->all() with $request->validated() to block mass
- assignment of fillable...
- Added company_id scoping to prevent cross-company supplier modification.
- Replaced $request->all() with $request->validated() to block mass
- assignment of fillable...
🚨 CVE-2024-22373
An out-of-bounds write vulnerability exists in the JPEG2000Codec::DecodeByStreamsCommon functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
🎖@cveNotify
An out-of-bounds write vulnerability exists in the JPEG2000Codec::DecodeByStreamsCommon functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
🎖@cveNotify
🚨 CVE-2024-31828
Cross Site Scripting vulnerability in Lavalite CMS v.10.1.0 allows attackers to execute arbitrary code and obtain sensitive information via a crafted payload to the URL.
🎖@cveNotify
Cross Site Scripting vulnerability in Lavalite CMS v.10.1.0 allows attackers to execute arbitrary code and obtain sensitive information via a crafted payload to the URL.
🎖@cveNotify
jinmu1108.github.io
CVE-2024-31828 | J1Nmu
CVE-2024-31828 BUG_Author: F1sher Affected version: LavaLite CMS v.10.1.0 Vendor: https://github.com/LavaLite/cms Software: https://github.com/LavaLit
🚨 CVE-2024-31823
An issue in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary code via the removeSecondaryImage method of the Publish.php component.
🎖@cveNotify
An issue in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary code via the removeSecondaryImage method of the Publish.php component.
🎖@cveNotify
Gist
CVE-2024-31823
CVE-2024-31823. GitHub Gist: instantly share code, notes, and snippets.