CVE-2026-50774

An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the Company Manger role...

CVE-2026-50774: Improper Privilege Management

An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the Company Manger role...

CVE-2026-50774

An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the Company Manger role...

EUVD-2026-60352

An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the Company Manger role...

PT-2026-73207

A flaw has been found in Orange View Limited DualSafe Password Manager & Digital Vault Extension up to 1.4.35 on Chrome. Affected is an unknown function of the component postMessage-based Bridge. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. A...

PT-2026-76746

An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the Company Manger role...

CVE-2026-19992: Exposure of Sensitive Information to an Unauthorized Actor

A flaw has been found in Orange View Limited DualSafe Password Manager & Digital Vault Extension up to 1.4.35 on Chrome. Affected is an unknown function of the component postMessage-based Bridge. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. A...

WordPress Events Manager 7.4 Unauthenticated Administrator Privilege Escalation

WordPress Events Manager versions 7.4 and below contain an unauthenticated privilege escalation vulnerability caused by improper capability mapping for event and location post identifiers. An unauthenticated attacker can exploit a collision between a WordPress user ID and an Events Manager post I...

CVE-2026-50774

An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the Company Manger role . The vulnerability is classified with a CRITICAL base severity score of 9.8 , indicating high impact on confidentiality, integrity, and availability. While the exploitation method is ide...

CVE-2026-50774

An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the Company Manger role...

Ivanti Endpoint Manager < 2024 SU7 Multiple Vulnerabilities

The version of Ivanti Endpoint Manager running on the remote host is prior to 2024 SU7. It is, therefore, affected by multiple vulnerabilities: - An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent servic...

Exploit for CVE-2026-18366

CVE-2026-18366 Events Manager 7.4.1 - Unauthenticated Pri...

CVE-2026-17581

The WCPOS – Point of Sale POS plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and including, 1.9.14 due to the ReceiptRendererFactory dispatching templates with the 'thermal' engine to the LegacyPhpRenderer inste...

CVE-2026-15351 WC Vendors <= 2.7.0 - Authenticated (Shop Manager+) SQL Injection via 'status' Parameter

The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to generic SQL Injection via the 'status' parameter in all versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-17581 WCPOS <= 1.9.14 - Authenticated (Shop Manager+) Code Injection via 'thermal' Template Engine

The WCPOS – Point of Sale POS plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and including, 1.9.14 due to the ReceiptRendererFactory dispatching templates with the 'thermal' engine to the LegacyPhpRenderer inste...

CVE-2026-17581 WCPOS <= 1.9.14 - Authenticated (Shop Manager+) Code Injection via 'thermal' Template Engine

The WCPOS – Point of Sale POS plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and including, 1.9.14 due to the ReceiptRendererFactory dispatching templates with the 'thermal' engine to the LegacyPhpRenderer inste...

CVE-2026-17581

The CVE concerns the WCPOS – Point of Sale (POS) plugin for WooCommerce (WordPress). Affected versions: up to 1.9.14. Root cause: the Receipt_Renderer_Factory dispatches templates using the thermal engine to the Legacy_Php_Renderer instead of a safe thermal-specific renderer, enabling Code Inject...

CVE-2026-15009

The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter in all versions up to, and including, 5.4.12 due to insufficient input sanitization and output escaping. Th...

CVE-2026-15009

The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter in all versions up to, and including, 5.4.12 due to insufficient input sanitization and output escaping. Th...

CVE-2026-15009 Advanced File Manager <= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter

The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter in all versions up to, and including, 5.4.12 due to insufficient input sanitization and output escaping. Th...