EUVD-2026-80198

The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation...

CVE-2026-85572 Tutor LMS 4.0.0 - < 4.0.8 - Subscriber+ Cross-Course Lesson Comment Disclosure

The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation...

EUVD-2026-80186

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its report-printing routines, allowing unauthenticated users to retrieve WooCommerce order details and customer contact information, to target an individual order, and ...

CVE-2026-74926 MultiVendorX 5.0.0 - 5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite via stores REST Endpoint

The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it...

kernel: selinux: fix overlayfs mmap() and mprotect() access checks

A flaw was found in the Linux kernel's SELinux security module when handling overlayfs. The existing security model for overlayfs does not properly enforce access controls for mmap and mprotect operations. This oversight could allow a local attacker to bypass intended security policies, potential...

kernel: selinux: fix overlayfs mmap() and mprotect() access checks

A flaw was found in the Linux kernel's SELinux security module when handling overlayfs. The existing security model for overlayfs does not properly enforce access controls for mmap and mprotect operations. This oversight could allow a local attacker to bypass intended security policies, potential...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38416)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the getPairCfg function. Attackers can exploit this vulnerability by sending a specially crafted POST reque...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38556)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the setStaticDhcpRules function. Attackers can exploit this vulnerability by sending a specially crafted PO...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38588)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to improper access control. This vulnerability stems from improper access control in the keepAlive function. Attackers can exploit this vulnerability by sending specially crafted MQTT...

PT-2026-93299

The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38411)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the delVlanCfg function. Attackers can exploit this vulnerability by sending a specially crafted POST reque...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38594)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability in access control. This vulnerability stems from an improper access control in the recvIndirectMeshInfo function. Attackers can exploit this vulnerability by sending specially crafted MQTT...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38593)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from incorrect access control in the recvClearPairCfg function. Attackers can exploit this vulnerability by sending a specially crafted MQT...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38422)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. There is an access control vulnerability in the TOTOLINK T6. This vulnerability stems from improper access control in the LoadDefSettings function. Attackers can exploit this vulnerability by sending a specially crafted POST...

PT-2026-93952

Name of the Vulnerable Software and Affected Versions Cisco Secure Firewall Adaptive Security Appliance ASA Software affected versions not specified Cisco Secure Firewall Threat Defense FTD Software affected versions not specified Description A logic error in the access control list ACL Object...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38589)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the meshInfoKick function. Attackers can exploit this vulnerability by sending specially crafted MQTT...

PT-2026-93316

The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing several board-management operations, checking only board membership. This allows any member of a board to carry out manager-only actions on it, including adding or...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38557)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. There is an access control vulnerability in TOTOLINK T6. This vulnerability stems from incorrect access control in the setStorageCfg function. Attackers can exploit this vulnerability by sending a specially crafted POST request...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38587)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the informSyncUpgfw function. Attackers can exploit this vulnerability by sending specially crafted MQTT...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38435)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from the setParentalRules function not properly implementing access control mechanisms. Attackers can exploit this vulnerability by sending...