CVE-2026-85133 WPLP Cookie Consent < 4.4.2 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent...

CVE-2026-80339

The Payment Plugins for Stripe WooCommerce WordPress plugin versions before 4.0.12 is vulnerable to unauthenticated customer PII disclosure . The flaw exists because the plugin fails to validate the order key before including order data in the JavaScript configuration output on the front end. An ...

CVE-2026-21086

Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration...

EUVD-2026-74627

Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration...

CVE-2026-21086

Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration...

CVE-2026-21086

Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration...

CVE-2026-21086

A vulnerability exists in ProxyHandler within systems prior to SMR Aug-2026 Release 1 . Due to improper authorization , a local attacker can gain unauthorized access to the proxy configuration . While the vulnerability's impact is noted as high in certain metrics (CVSS 3.1), no specific exploits ...

SUSE CVE-2026-19614

The API is prone to XML external entity XXE injection. By default, XML external entity support is enabled. This issue affects NanoXML: 2.2.3...

PT-2026-89083

CWE-88: Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters...

EUVD-2026-75162

An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file, which is not overridden or removed in the production environment profile. A remote, unauthenticated attacker can locally forge valid...

SAP NetWeaver AS ABAP Missing Authorization Check (3772838)

The version of SAP NetWeaver AS ABAP detected on the remote host is affected by a missing authorization check vulnerability as referenced in SAP Security Note 3772838: - Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker...

PT-2026-88820

Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration...

PT-2026-89149

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuratio...

CVE-2026-21086: Improper Input Validation

Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration...

CVE-2026-8044: Improper Neutralization of Argument Delimiters in a Command

CWE-88: Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters...

PT-2026-89250

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module stores sensitive authentication information in a manner that could allow disclosure to users with access to configuration or related...

CVE-2026-50165: Improper Access Control

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuratio...

Security Advisory 0176

Security Advisory 0176 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-73469 CVSSv3.1 Base Score: 5.8...

Linux Distros Unpatched Vulnerability : CVE-2026-82067

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default...

HPESBNW05130 rev.1 - Multiple Vulnerabilities in HPE Aruba Networking ClearPass Policy Manager (CPPM)

Potential Security Impact: Remote: Code Execution, Denial of Service DoS, Unqualified Configuration Change SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba ClearPass Enterprise Software See the Affected Products section for version details. Aruba ClearPass Policy Manager See...