EUVD-2026-107283

The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls. A privilege escalation vulnerability in pfSense-pkg-RESTAPI prior to version 2.9.0 allows authenticated accounts holding the dedicated settings sync permission to modify REST...

WordPress WholesaleX plugin < 3.0.9 - Unauthenticated Account Activation and Administrator Approval Bypass vulnerability

Unauthenticated Account Activation and Administrator Approval Bypass vulnerability discovered by Naoki Kawahigashi in WordPress Plugin WholesaleX versions 3.0.9...

CVE-2024-49328

CVE-2024-49328 WP REST API FNS ; rel="https://api.w.org/" X-Content-Type-Options: nosniff Access-Control-Expose-Headers: X-WP-Total, X-WP-TotalPages, Link Access-Control-Allow-Hea...

CVE-2025-6934

🛡️ CVE-2025-6934 - Unauthenticated Privilege Escalation in Opal Estate Pro 📝 Description The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme , is vulnerable to Privilege Escalation in all versions up to and...

CVE-2026-111955

The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accounts and bypass the administrator approval required before login...

CVE-2026-107128

The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own sit...

CVE-2026-107506

The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a low-privileged role to escalate their privileges and...

CVE-2022-43959

CVE-2022-43959 Bitrix Vulnerability CVE-2022-43959 Description Insufficiently Protected Credentials in the AD/LDAP server settings in 1C-Bitrix Bitrix24 AD/LDAP connector module before version 23.100.0 allow remote administrators to discover an AD/LDAP administrative password by reading the sourc...

EUVD-2026-107077

The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accounts and bypass the administrator approval required before login...

CVE-2026-111955 WholesaleX < 3.0.9 - Unauthenticated Account Activation and Administrator Approval Bypass

The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accounts and bypass the administrator approval required before login...

CVE-2026-111955 WholesaleX < 3.0.9 - Unauthenticated Account Activation and Administrator Approval Bypass

The WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied in a request, allowing unauthenticated users to activate pending accounts and bypass the administrator approval required before login...

CVE-2026-111955

The WholesaleX WordPress plugin (versions before 3.0.9 ) is vulnerable to an Improper Authentication flaw (CWE-287 ). The software fails to verify if a stored account confirmation code exists before comparing it against a code provided in an incoming request. This oversight allows unauthenticated...

EUVD-2026-107061

The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a low-privileged role to escalate their privileges and...

EUVD-2026-107059

The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own sit...

CVE-2026-105044

Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform Host Monitoring V3.0 allows an authenticated console administrator to execute arbitrary commands on attached clients via OS command injection...

EUVD-2026-106928

Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform Host Monitoring V3.0 allows an authenticated console administrator to execute arbitrary commands on attached clients via OS command injection...

CVE-2026-105044

The Qingteng Host Adaptive Security Platform (Host Monitoring) V3.0 is vulnerable to OS command injection in the Security Toolbox component. The root cause is the improper neutralization of special elements used in an OS command. This flaw affects versions prior to 20260929 and allows an authenti...

CVE-2026-105044 OS Command Injection in Qingteng Host Adaptive Security Platform Security Toolbox

Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform Host Monitoring V3.0 allows an authenticated console administrator to execute arbitrary commands on attached clients via OS command injection...

PT-2026-120287

Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform Host Monitoring V3.0 allows an authenticated console administrator to execute arbitrary commands on attached clients via OS command injection...

PT-2026-120456

The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a low-privileged role to escalate their privileges and...