CVE-2026-15894 Bluetooth Mesh solicitation PDU stack buffer overflow via oversized advertisement

The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source length. In solpdudecrypt, out is allocated as NETBUFSIMPLE17 and then filled with...

CVE-2026-104678

The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player WordPress plugin...

CVE-2026-82212 Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Bypass via NPG Notification Handler

The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid...

CVE-2026-82212

The Nexi XPay Build WordPress plugin (version 7.6.2 and below ) contains a vulnerability where the payment notification route fails to correctly validate the security token. Specifically, the plugin accepts requests when the target order lacks a stored token. This allows unauthenticated attackers...

CVE-2026-104678

The CP Media Player WordPress plugin (versions before 1.3.4 ) is vulnerable to an improper access control flaw in its settings-page handler . Due to a lack of capability checks, users with only Contributor-level access can perform actions reserved for administrators, such as creating, modifying, ...

CVE-2026-104678 CP Media Player < 1.3.4 - Contributor+ Media Player Settings Update

The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player WordPress plugin...

CVE-2026-104678 CP Media Player < 1.3.4 - Contributor+ Media Player Settings Update

The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player WordPress plugin...

CVE-2026-19572

A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator session without providing valid credentials...

EUVD-2026-94166

A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator session without providing valid credentials...

CVE-2026-19572

A security vulnerability exists in FlexNet Publisher lmadmin within a SOAP handler . A hardcoded authentication bypass allows an unauthenticated user to obtain a privileged administrator session without providing valid credentials. No information regarding specific affected versions, remediation ...

CVE-2026-19572 FlexNet Publisher lmadmin SOAP Authentication Bypass Vulnerability

A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator session without providing valid credentials...

CVE-2026-19572 FlexNet Publisher lmadmin SOAP Authentication Bypass Vulnerability

A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator session without providing valid credentials...

PT-2026-107406

The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player WordPress plugin...

CVE-2025-70517

The request handler in Fanvil x7a firmware version 2.6.0.1182 fails to enforce cross-origin resource protection for state-changing requests. This lack of protection allows for a complete bypass of the cross-origin boundary, enabling Cross-Site Request Forgery (CSRF) attacks against any applicatio...

CVE-2026-19572: Authentication Bypass Using an Alternate Path or Channel

A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator session without providing valid credentials...

PT-2026-107527

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests...

CVE-2026-104678: Improper Access Control

The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player WordPress plugin...

CVE-2025-70520: Missing Authentication for Critical Function

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests...

CVE-2025-70516: Missing Authentication for Critical Function

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests...

PT-2026-107524

Name of the Vulnerable Software and Affected Versions Fanvil x7a version 2.6.0.1182 Description The request handler fails to enforce cross-origin resource protection for state-changing requests. This allows the cross-origin boundary to be bypassed, enabling Cross-Site Request Forgery CSRF attacks...