SUSE CVE-2026-89444

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer setattribute populates the security area of the BIOS attribute request buffer with the current admin password via populatesecuritybuffer, then dumps the whol...

CVE-2026-90541 WWBN AVideo Unauthenticated Information Disclosure via menus.json.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to require authentication in the plugin/TopMenu/menus.json.php endpoint, allowing unauthenticated attackers to retrieve all menu data. Attackers can send GET requests to the endpoint to read inactive and admin-only menu nam...

CVE-2026-90539 WWBN AVideo Missing Authentication via menuItems.json.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authentication vulnerability in the plugin/TopMenu/menuItems.json.php endpoint that allows unauthenticated attackers to read inactive admin menu items by submitting a POST request with a menuId parameter...

EUVD-2026-76857

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authentication vulnerability in the plugin/TopMenu/menuItems.json.php endpoint that allows unauthenticated attackers to read inactive admin menu items by submitting a POST request with a menuId parameter...

CVE-2026-90539 WWBN AVideo Missing Authentication via menuItems.json.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authentication vulnerability in the plugin/TopMenu/menuItems.json.php endpoint that allows unauthenticated attackers to read inactive admin menu items by submitting a POST request with a menuId parameter...

CVE-2026-90539

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 has a missing authentication flaw in the plugin/TopMenu/menuItems.json.php endpoint. An unauthenticated attacker can send a POST request with a menuId parameter to read inactive admin menu items, retrieving hidden menu item URLs ...

CVE-2026-84024

The BEAR – Bulk Editor and Products Manager Professional for WooCommerce WordPress plugin, in versions prior to 1.2.2 , is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a failure to verify a CSRF nonce before saving the plugin's meta field configuration . An attacker...

CVE-2026-77752 Temporary Login Without Password 1.5 - 1.9.8 - Multisite Subsite Admin+ Network Super Admin Privilege Escalation

The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole...

EUVD-2026-76811

The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole...

CVE-2026-77752

The Temporary Login Without Password WordPress plugin (versions 1.5-1.9.8 ) is vulnerable to a privilege escalation flaw. The plugin fails to verify that the user requesting a temporary login possesses network super admin rights before granting those rights to a new account. This allows a single ...

WordPress Temporary Login Without Password plugin 1.5-1.9.8 - Multisite Subsite Admin+ Network Super Admin Privilege Escalation vulnerability

Multisite Subsite Admin+ Network Super Admin Privilege Escalation vulnerability discovered by BaptouTatis in WordPress Plugin Temporary Login Without Password versions 1.5-1.9.8...

CVE-2026-89267

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchablefields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality an...

EUVD-2026-76773

QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary...

CVE-2026-89267 starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchablefields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality an...

CVE-2026-89267 starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchablefields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality an...

EUVD-2026-76772

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchablefields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality an...

CVE-2026-89267

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when it is configured as an empty list. As a result, authenticated users can submit structured filter queries via the list API's where parameter to perform equality and comparison operations on columns ...

CVE-2026-89267 starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchablefields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality an...

EUVD-2026-76738

An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that...

EUVD-2026-76737

The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is written with permissions allowing it to be read by any local user. This is inconsistent with a separate, stronger hashing...