EUVD-2026-100883

The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing...

CVE-2026-106099

The WP Data Access WordPress plugin (versions before 5.5.84 ) is vulnerable to unauthenticated sensitive data disclosure . The plugin fails to restrict its database table export action to authorized users, instead relying on a token that is publicly printed on the pages where tables are displayed...

CVE-2026-106099 WP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table Export

The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token that the WP Data Access WordPress plugin before 5.5.84 itself prints into the public pages on which it displays a table, allowing unauthenticated...

CVE-2026-104751

The Rank Math SEO WordPress plugin, in versions prior to 1.0.280 , is vulnerable to an unauthenticated action where users can delete stored SEO analysis data. The root cause is the failure to perform necessary capability or nonce checks before clearing this data. No specific exploit links or furt...

EUVD-2026-100877

The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its stored SEO analysis data, allowing unauthenticated users to delete it...

EUVD-2026-100880

The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result from client-supplied parameters, allowing unauthenticated attackers to mark payment records as paid, destroy genuine payment...

EUVD-2026-100881

The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access ev...

WordPress WP Data Access plugin < 5.5.77 - Unauthenticated Incorrect Authorization vulnerability

Unauthenticated Incorrect Authorization vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Data Access versions 5.5.77...

CVE-2026-106098

The WP Data Access WordPress plugin (versions before 5.5.77 ) contains an unauthenticated incorrect authorization vulnerability. The root cause is that one of the application's REST endpoints fails to properly validate permissions, verifying only read access before executing a write operation. Th...

CVE-2026-106098 WP Data Access < 5.5.77 - Unauthenticated Incorrect Authorization via Inline App Update

The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access ev...

CVE-2026-92389

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode,...

UBUNTU-CVE-2026-92389

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode,...

CVE-2026-87863

An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache...

UBUNTU-CVE-2026-87863

An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache...

CLEANSTART-2026-HI23870 Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Web Services)

Security vulnerability affects the openjdk11 package. Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion component: Web Services...

CLEANSTART-2026-ZO47160 `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL re...

CVE-2026-79993 affects multiple packages. The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. See references for...

EUVD-2026-100653

Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil-pointer dereference in request decoding

A flaw was found in kin-openapi. An unauthenticated remote attacker can cause a Denial of Service DoS by sending specially crafted HTTP requests containing specific array query parameters or form-encoded data. Because the request decoder fails to properly validate certain array schemas before...

PT-2026-114146

Name of the Vulnerable Software and Affected Versions FreeRDP versions 2.0.0 through 3.31.0 Description An issue exists in the wts read drdynvc data first function that allows authenticated clients to cause server resource exhaustion. By sending a seven-byte DATA FIRST message on an opened Dynami...

CVE-2026-108151: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Code Injection.This issue affects MDTF: from n/a through 1.3.9...