CVE-2026-16039

The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information...

CVE-2026-14943

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read...

CVE-2026-16039 MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR

The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information...

EUVD-2026-54377

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read...

ROOT-OS-DEBIAN-13-CVE-2026-23251 CVE-2026-23251 in linux - Patched by Root

Root has patched CVE-2026-23251 in the linux package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-23375 CVE-2026-23375 in linux - Patched by Root

Root has patched CVE-2026-23375 in the linux package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-68307 CVE-2025-68307 in linux - Patched by Root

Root has patched CVE-2025-68307 in the linux package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-68287 CVE-2025-68287 in linux - Patched by Root

Root has patched CVE-2025-68287 in the linux package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2019-15213 CVE-2019-15213 in linux - Patched by Root

Root has patched CVE-2019-15213 in the linux package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-71204 CVE-2025-71204 in linux - Patched by Root

Root has patched CVE-2025-71204 in the linux package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-39812 CVE-2025-39812 in linux - Patched by Root

Root has patched CVE-2025-39812 in the linux package for Root:Debian:13. Multiple fixed versions available...

CVE-2026-11907

CVE-2026-11907 concerns the WordPress Stream plugin (

CVE-2026-49005 Root password hash exposure vulnerability in ZTE F689 product

The root password hash of the device can be obtained through unencrypted information in the firmware...

CVE-2026-49005

CVE-2026-49005 affects ZTE F689 devices, where the root password hash can be obtained from unencrypted firmware information. The CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) yields a LOW base score (2.4), indicating limited impact to confidentiality. The description confirms leakage of t...

CVE-2026-63508

creationtimestamp| type| source ---|---|--- 2026-08-07 02:00:34+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mshhjejdcq2n 2026-08-07 04:30:24+00:00| seen| https://infosec.exchange/users/offseq/statuses/117052343857368722 2026-08-07 04:30:27+00:00| seen|...

EUVD-2026-54319

Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network...

EUVD-2026-54320

Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network...

EUVD-2026-54229

diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of any entity and returns those values for all rows, with no field or entity allowlist. The only guard, relatedDataSecurityCheck, returns true unconditionally, so any authenticated...

EUVD-2026-54161

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder libavcodec/rscc.c that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes...

EUVD-2026-54279

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...