CVE-2026-12272 Lightweight Cookie Notice <= 1.19 - Sensitive Information Exposure via W3TC_DYNAMIC_SECURITY Constant

The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.19 This is due to the W3TCDYNAMICSECURITY constant being hardcoded to a publicly known value. This makes it possible for...

CVE-2026-109400

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via addmanagementpage using a role name returned by InstaWPSetting::getallowedrole as...

CVE-2026-109400 InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via addmanagementpage using a role name returned by InstaWPSetting::getallowedrole as...

CVE-2026-109400

The InstaWP Connect WordPress plugin (versions ©= 0.1.4.1 ) is vulnerable to Privilege Escalation due to improper privilege management and API Key Disclosure . The plugin incorrectly uses a role name as a capability in add_management_page(), and generate_section_field() renders the master API key...

CVE-2026-109400 InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via addmanagementpage using a role name returned by InstaWPSetting::getallowedrole as...

EUVD-2026-102643

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via addmanagementpage using a role name returned by InstaWPSetting::getallowedrole as...

CVE-2026-111445

Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey and existskey=. For existskey=, production with error information disabled returns true for an out-of-scope key instead of throwing. Applications relying on scopes for ownership or...

CVE-2026-111447

Wheels 1.1 through 4.1.2 resolves nestedProperties records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne rows, or delete them when...

EUVD-2026-102611

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products.variants.' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

EUVD-2026-102607

Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey and existskey=. For existskey=, production with error information disabled returns true for an out-of-scope key instead of throwing. Applications relying on scopes for ownership or...

CVE-2026-111445

The Wheels framework versions 4.0.0 through 4.1.2 (before 4.2.0 ) is vulnerable to a flaw where incoming scope conditions are replaced with a primary-key condition in findByKey() and exists(key=) . Specifically, in exists(key=) , if production error information is disabled, the system may return ...

CVE-2026-111445

Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey and existskey=. For existskey=, production with error information disabled returns true for an out-of-scope key instead of throwing. Applications relying on scopes for ownership or...

CVE-2026-111445

Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey and existskey=. For existskey=, production with error information disabled returns true for an out-of-scope key instead of throwing. Applications relying on scopes for ownership or...

CVE-2026-111445

Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey and existskey=. For existskey=, production with error information disabled returns true for an out-of-scope key instead of throwing. Applications relying on scopes for ownership or...

CVE-2026-111388

Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrictip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses...

CVE-2026-109812

A missing authorization vulnerability exists in the internal API /api/v1/secrets/ of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the...

CVE-2026-109813

A hard-coded cryptographic key vulnerability exists in the /usr/bin/sysman of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications...

CVE-2026-109813

A hard-coded cryptographic key vulnerability exists in the /usr/bin/sysman component of certain Moxa industrial computing products . An unauthenticated attacker with adjacent network access can exploit the exposed private key material to compromise the confidentiality and integrity of communicati...

EUVD-2026-102594

A hard-coded cryptographic key vulnerability exists in the /usr/bin/sysman of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications...

CVE-2026-109813 Shared Hard-coded Root CA Private Key

A hard-coded cryptographic key vulnerability exists in the /usr/bin/sysman of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications...