CVE-2026-111696: Use of Hard-coded Cryptographic Key

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via...

CVE-2026-91830: Exposure of Sensitive Information to an Unauthorized Actor

The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to disclose a subscriber's management key and silently alter that subscriber's subscriptions...

CVE-2026-111388: Improper Access Control

Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrictip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses...

CVE-2026-109813: Use of Hard-coded Cryptographic Key

A hard-coded cryptographic key vulnerability exists in the /usr/bin/sysman of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications...

CVE-2026-111445: Incorrect Resource Transfer Between Spheres

Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey and existskey=. For existskey=, production with error information disabled returns true for an out-of-scope key instead of throwing. Applications relying on scopes for ownership or...

PT-2026-115430

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via add management page using a role name returned by InstaWP Setting::get allowed rol...

PT-2026-115408

Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey and existskey=. For existskey=, production with error information disabled returns true for an out-of-scope key instead of throwing. Applications relying on scopes for ownership or...

CVE-2026-111633: Use of Hard-coded Cryptographic Key

ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize...

PT-2026-115397

Name of the Vulnerable Software and Affected Versions Moxa industrial computing products affected versions not specified Description A missing authorization issue exists in the internal API endpoint /api/v1/secrets/. A low-privileged authenticated attacker with adjacent network access can exploit...

PT-2026-115398

Name of the Vulnerable Software and Affected Versions Moxa industrial computing products affected versions not specified Description Two separate issues affect the system. First, a hard-coded cryptographic key exists in the /usr/bin/sysman binary, which an unauthenticated attacker with adjacent...

PT-2026-115480

Name of the Vulnerable Software and Affected Versions Subscribe to Comments WordPress plugin versions prior to 2.3.3 Description The plugin fails to sign or validate a cookie used to identify commenters. This allows unauthenticated attackers to disclose a subscriber's management key and silently...

PT-2026-115539

Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted Identifiers. This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

PT-2026-115901

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. ...

PT-2026-116011

netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the...

PT-2026-115913

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. ...

PT-2026-116095

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via...

PT-2026-116020

TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/key. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner...

PT-2026-115591

Name of the Vulnerable Software and Affected Versions SmartCrawl versions prior to 3.16.5 Description An authorization bypass exists due to a user-controlled key, which allows the exploitation of incorrectly configured access control security levels. Recommendations Update SmartCrawl to version...

CVE-2026-109400: Improper Privilege Management

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via addmanagementpage using a role name returned by InstaWPSetting::getallowedrole as...

CVE-2026-92777: Use of Default Cryptographic Key

A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code...