CVE-2025-13296

In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow.

In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators.

The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce. The guard meant to protect roles with assigned users reads a different part of the request than the one selecting what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, permanently stripping every user of their capabilities.

Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) through 7.1.3 allows Privilege Escalation.

Deserialization of Untrusted Data vulnerability in Radius Booking — Booking Calendar for Appointments & Services through 1.0.20 allows Object Injection.

The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.

Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands.

Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.

In Kubeflow Pipelines prior to 2.18.0, the multi-user HTTP endpoints for uploading pipelines and pipeline versions skip SubjectAccessReview when the target namespace is empty and REQUIRE_NAMESPACE_FOR_PIPELINES defaults to false. A low-privilege tenant can create shared pipelines or inject attacker-controlled versions into existing shared pipelines without the required write permission. If the API server is directly reachable without an authenticating proxy, an unauthenticated caller can exploit the same bypass.

BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND node. The exposed macaroon can be used to gain full control of the LND node, including moving funds, resulting in theft of funds.