CVE-2026-105998 Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features...

WordPress Booking Package plugin < 1.7.31 - Unauthenticated Subscription Deactivation vulnerability

Unauthenticated Subscription Deactivation vulnerability discovered by Md. Minaruzzaman Shovon in WordPress Plugin Booking Package versions 1.7.31...

CVE-2026-105998

The Booking Package WordPress plugin (versions before 1.7.31 ) is vulnerable to an unauthenticated subscription deactivation due to missing authorization and validity checks. An unauthenticated attacker can trigger a reset of the plugin's premium subscription state, effectively disabling the plug...

CVE-2020-36730

CVE-2020-36730 CMP - Coming Soon & Maintenance 3.8.2 - Improper Access Controls on AJAX Calls Subscriber+ Description: Some of the AJAX calls from the plugin do not properly check for capabilities and CSRF tokens, leading to issues such as arbitrary post read, subscribers list export and plugin...

cve-2023-6931-pipa

CVE-2023-6931 — Xiaomi Pad 6 pipa Privilege Escalation and Disabling SELinux The final version of the exploit used on the device, organized separately in this directory. Target Device Xiaomi Pad 6 / pipa / SM8250 System HyperOS OS2.0.20.0.UMZCNXM Kernel 4.19.157-perf-g240e1d0a5f52 Start adb shell...

ListingPro < 2.6.1 - Arbitrary Plugin Installation/Activation/Deactivation

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lpccaddonsactions function. This makes it possible for unauthenticated attacker...

CVE-2026-13156

CVE-2026-13156 — MailerSend Official SMTP Integration !IMPORTANT Abstract: A High-Severity Cross-Site Request Forgery CSRF vulnerability CVE-2026-13156 was discovered in the official MailerSend SMTP Integration plugin for WordPress 1.0.8. The configuration eradication handler...

CVE-2025-67315

CSRF to Deactivate Any Employee Summary The Manage Employees functionality is vulnerable to Cross-Site Request Forgery CSRF. An attacker can trick a logged-in admin into sending a forged request that inactivates an employee e.g., inid=1 without the admin’s knowledge or consent. CVSS Base Score: 5...

Linux Distros Unpatched Vulnerability : CVE-2026-78357

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. A...

CVE-2026-78357

Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approximately 16 hours. An attacker who has...

UBUNTU-CVE-2026-78357

Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approximately 16 hours. An attacker who has...

CVE-2026-78357

Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approximately 16 hours. An attacker who has...

EUVD-2026-97267

Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approximately 16 hours. An attacker who has...

CVE-2026-78357 Insufficient Session Revocation for JWT Authentication

Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approximately 16 hours. An attacker who has...

CVE-2026-78357

The OTRS helpdesk software versions 7.0.X , 8.0.X , 2023.X , 2024.X , 2025.X , and 2026.X before 2026.7.X are vulnerable to insufficient session revocation for JWT authentication . The root cause is that authentication tokens are not immediately invalidated when a user account is deactivated or a...

CVE-2026-78357: Insufficient Session Expiration

Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approximately 16 hours. An attacker who has...

PT-2026-110489

Name of the Vulnerable Software and Affected Versions OTRS versions 7.0.X OTRS versions 8.0.X OTRS versions 2023.X OTRS versions 2024.X OTRS versions 2025.X OTRS versions prior to 2026.7.X Description Authentication tokens are not immediately invalidated when an agent or customer user account is...

aws-key-disabler

AWS Lambda - Desactivador de Claves de Acceso IAM El desactivador de claves de AWS es una función Lambda que desactiva las claves de acceso de usuarios IAM de AWS después de un tiempo determinado para reducir el riesgo asociado a claves de acceso antiguas. Arquitectura de AWS Lambda Salida de...

WordPress Code Snippets plugin < 3.10.0 - Admin+ Network-Scoped Snippet Activation and Deactivation vulnerability

Admin+ Network-Scoped Snippet Activation and Deactivation vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Code Snippets versions 3.10.0...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/sched: schqfq: Fixed a NULL dereference when deactivating an inactive aggregate in qfqreset. qfqclass-leafqdisc-q.qlen 0 does not imply that the class itself is active. Two qfqclass objects may point to the same leafqdisc. Th...