CVE-2026-105664

The Guangzhou Juan IoT Technology EseeCloud platform is vulnerable to an observable response discrepancy (CWE-204) when processing ID values. An attacker possessing a valid access token can distinguish valid, registered IDs from the 10-digit numeric search space because the system returns differe...

EUVD-2026-102880

The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response code from one submitted with a valid, registered ID, allowing an attacker holding a valid access token - but without further authenticatio...

EUVD-2026-102879

An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID...

CVE-2026-97858

A vulnerability exists in Guangzhou Juan IoT Technology EseeCloud (CWE-915) where an attacker can trigger the server to unbind a target device from its current owner and rebind it to the requesting account. This action can be performed regardless of whether the device is already associated with a...

CVE-2026-19603 Private channel ID disclosure via user status endpoints

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID of a private channel another user is actively viewing via the...

CVE-2026-19603

Mattermost versions 11.9.x <= 11.9.1 , 11.8.x <= 11.8.5 , 11.7.x <= 11.7.10 , and 11.10.x

CVE-2026-110014 Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status

The Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users'...

WordPress Salon Booking System plugin < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status vulnerability

Unauthenticated Booking Creation with Arbitrary Customer ID and Status vulnerability discovered by Raphael P. Cigana in WordPress Plugin Salon booking system versions 10.31.9...

santa

Santa !NOTE As of 2025, Santa is no longer maintained by Google. We encourage existing users to migrate to an actively maintained fork of Santa, such as https://github.com/northpolesec/santa. Santa is a binary and file access authorization system for macOS. It consists of a system extension that...

EUVD-2026-102654

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id post ID in /wp-json/wp/v2/modula-gallery/id or none for collection route' parameter. This makes it possible for...

MS09-050

MS09-050 — SMBv2 Remote Code Execution Exploit CVE-2009-3103 The Vulnerability Windows Vista and Server 2008 introduced SMBv2 with a new kernel driver, srv2.sys. This driver fails to validate the Process Id High field in SMB negotiate requests. By sending a specially crafted value in this field, ...

CVE-2026-111386

The Nezha platform, versions 1.7.0 before 2.3.15 , is vulnerable to an information disclosure flaw. Authenticated members can perform Cross-Tenant Server-ID Enumeration by leveraging differential responses from the getServerConfig and setServerConfig functions. By sweeping sequential IDs, an atta...

EUVD-2026-102497

Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or...

EUVD-2026-102489

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id. Attackers can request GET /api/v1/messages/conversation/:id, which lacks participant checks, to obtain full message histor...

EUVD-2026-102487

pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via GET /admin/user/details/id. Low-privilege attackers can enumerate sequential user ids to obtain usernames, real names, phone numbers,...

EUVD-2026-102486

OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxishares share-ring cookie can request content via GET /api/files/id to read shared files or folder...

PT-2026-115494

Name of the Vulnerable Software and Affected Versions WebberZone Top 10 — Popular Posts versions prior to 4.5.3 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. By setting...

PT-2026-116047

BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other administrators' profiles via the id parameter. Attackers holding the routine/adminInfo/edit permission can overwrite avatar, nickname, email, mobile...

PT-2026-116086

WeRSS we-mp-rss through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/feed id endpoint. Attackers can supply a non-built-in ext value and a =expression template whose object-subclass travers...

PT-2026-116046

PickMall lilishop through 5.0.0 contains an insecure direct object reference vulnerability that allows authenticated buyers to read other buyers' invoice records because ReceiptServiceImpl.getDetail performs no ownership check. Attackers can supply another buyer's receipt id to GET...