CVE Notifier

CVE-2026-16582 CWE-862 5.3

Booking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. This is due to the plugin accepting a client-…

Wordfence melograno:Booking · for · Appointments 2 hari lalu

CVE-2026-14311 CWE-862 5.4

Booking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing ownership verification on /users/customers/<id> endpoint in a…

Wordfence melograno:Booking · for · Appointments 2 hari lalu

CVE-2026-16750 CWE-862 5.3

Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvl_ajax_dealer_load_cars() function in all versions up to…

Wordfence stylemix:Motors · – · Car 2 hari lalu

CVE-2026-93426 CWE-89 8.5

SigNoz 0.87.0 before 0.142.0 - SQL Injection in v5 Query Builder Field Key Names

SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API, allowing authenticated users to inject SQL. Attackers with Viewer role or higher can embed backticks…

cve.org SigNoz:signoz 2 hari lalu

CVE-2026-73639 CWE-787 N/A

Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8

Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8. With a tRNS chunk, read_direct8() adds an alpha channel to t…

cve.org 2 hari lalu

CVE-2026-73638 CWE-125 N/A

Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_ifd

Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_ifd. tiff_load_ifd() validates an IFD entry's data by checking that `entry->offset + entry->size` s…

cve.org 2 hari lalu

CVE-2026-93386 CWE-451 N/A

CVE-2026-93386

UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

cve.org Google:Chrome 2 hari lalu

CVE-2026-93385 CWE-200 N/A

CVE-2026-93385

Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

cve.org Google:Chrome 2 hari lalu

CVE-2026-93378 CWE-862 N/A

CVE-2026-93378

Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: Me…

cve.org Google:Chrome 2 hari lalu

CVE-2026-93384 CWE-918 N/A

CVE-2026-93384

Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chro…

cve.org Google:Chrome 2 hari lalu

CVE-2026-93383 CWE-200 N/A

CVE-2026-93383

Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

cve.org Google:Chrome 2 hari lalu

CVE-2026-93380 CWE-367 N/A

CVE-2026-93380

Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted …

cve.org Google:Chrome 2 hari lalu