CVE-2026-71962 Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/download

Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypass...

CVE-2026-72719

Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twilio Channels to other accounts through the writable accountid parameter. This could break tenant isolation and cause cross-account...

CVE-2026-72719 Chatwoot: Cross-Account Resource Transfer via `account_id` Parameter

Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twilio Channels to other accounts through the writable accountid parameter. This could break tenant isolation and cause cross-account...

CVE-2026-6373

Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting. This issue affects WAH7601: through 20072026...

CVE-2026-12984

CVE-2026-12984 concerns Zyxel Networks WAH7601 (affected through 20072026). The vulnerability is described as Insufficiently Protected Credentials that allows retrieval of embedded sensitive data. Connected documents confirm the affected product and the core impact, but do not provide detailed ro...

CVE-2026-12984 Exposure of Sensitive Information to an Unauthorized Actor in Zyxel's WAH7601

Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data. This issue affects WAH7601: through 20072026...

CVE-2026-6373 Sensitive Data Exposure in Zyxel WAH7601 Router

Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting. This issue affects WAH7601: through 20072026...

CVE-2026-6373 Sensitive Data Exposure in Zyxel WAH7601 Router

Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting. This issue affects WAH7601: through 20072026...

CVE-2026-6373

CVE-2026-6373 affects Zyxel Networks WAH7601 routers (through 20072026). Described as exposure of sensitive system information to an unauthorized control sphere, enabling Web Application Fingerprinting. CVSS 3.1 base score 6.5 (Medium); metrics show Adjacent attack vector, no privileges required,...

WordPress Payment Forms for Paystack plugin <= 4.0.5 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Muhan Luo in WordPress Plugin Payment Forms for Paystack versions = 4.0.5...

CVE-2026-64653

A flaw was found in GitHub CLI. This vulnerability arises from the tool's failure to properly percent-encode variable path components in HTTP request URLs. An attacker could craft malicious repository or resource values containing URL path metacharacters. This could lead to the GitHub CLI...

CVE-2026-18666

The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password...

CVE-2026-17020

The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user including a Subscriber or self-registered customer account to disclose...

WordPress iCARRY plugin <= 2.9 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Legion Hunter in WordPress Plugin iCARRY versions = 2.9...

WordPress WooCommerce Appointments plugin <= 5.3.8 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by adhikara13 in WordPress Plugin WooCommerce Appointments versions = 5.3.8...

EUVD-2026-55003

The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee provider is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any...

CVE-2026-17020

The Salon Booking System WordPress plugin through 10.30.33 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user including a Subscriber or self-registered customer account to disclos...

CVE-2026-17020 Salon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII Disclosure

The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user including a Subscriber or self-registered customer account to disclose...

EUVD-2026-55007

The Salon Booking System WordPress plugin through 10.30.33 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user including a Subscriber or self-registered customer account to disclos...

EUVD-2026-55020

The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data name, email, phone, address stored in form drafts...