CVE-2026-64964: Generation of Predictable Numbers or Identifiers

ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functionality. Due to the use of predictable values related to user registration, an attacker who knows or can predict these values can guess valid account activation...

CVE-2026-45273

MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserver/handlers/admin.py applies the auth decorator but does not check the self.adminuser property, unlike the corresponding GET handler. Any...

EUVD-2026-62484

MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserver/handlers/admin.py applies the auth decorator but does not check the self.adminuser property, unlike the corresponding GET handler. Any...

CVE-2026-44472 Saleor: Account pre-hijacking vulnerability due to unverified anonymous order merge

Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use...

WordPress Everest Forms - Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints vulnerability

WordPress Everest Forms - Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin = 3.5.2 - Missing Authorization to Authenticated Delegated+ Arbitrary Plugin Activation via REST API and AJAX Endpoints vulnerability discovered by skyv3il in WordPress Plugin Everest Forms...

CVE-2026-13167

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

CVE-2026-13167

The CVE concerns the Everest Forms WordPress plugin (Contact/Payment Form, Quiz, Survey & Custom Form Builder with AI) with authorization bypass in all versions up to 3.5.2. The root cause is inadequate verification of a user’s authorization to perform actions, enabling authenticated attackers wi...

CVE-2026-13167 Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

EUVD-2026-59862

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

CVE-2026-13167

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

CVE-2026-13167 Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

PT-2026-73083

Name of the Vulnerable Software and Affected Versions Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI versions prior to 3.5.3 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific...

CVE-2026-73558 vLLM: Cross-User Data Leak Vulnerability

vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x 2 d in activationkernels.cu can cause actandmulkernel to consume another batched user's input, allowing a request processed in the same inference batch to receive a partial or...

CVE-2026-73558

The CVE concerns vLLM, an inference/serving engine for LLMs. Before version 0.27.0, an integer overflow in blockIdx.x * 2 * d within activation_kernels.cu enables act_and_mul_kernel to consume input from another user within the same inference batch, causing cross-user data leakage of partial or c...

CVE-2026-14182

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the accoun...

CVE-2026-18669

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to a privilege escalation as the result of a remote code execution vulnerability in the activation engine component. An authenticated attacker can execute a maliciously planted script with root authority...

CVE-2026-18669 IBM i is Affected By A Privilege Escalation Vulnerability []

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to a privilege escalation as the result of a remote code execution vulnerability in the activation engine component. An authenticated attacker can execute a maliciously planted script with root authority...

CVE-2026-18669 IBM i is Affected By A Privilege Escalation Vulnerability []

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to a privilege escalation as the result of a remote code execution vulnerability in the activation engine component. An authenticated attacker can execute a maliciously planted script with root authority...

EUVD-2026-57383

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to a privilege escalation as the result of a remote code execution vulnerability in the activation engine component. An authenticated attacker can execute a maliciously planted script with root authority...

CVE-2026-18669

IBM i versions 7.6, 7.5, 7.4, and 7.3 (5770-SS1) are affected by a privilege-escalation vulnerability (CVE-2026-18669) due to a remote code execution flaw in the activation engine component. An authenticated attacker can run a malicious script with root privileges. CVSS v3.1 base score is 8.8 (AV...