EUVD-2026-103397

The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types...

CVE-2026-110069

The Modern Events Calendar Lite WordPress plugin, in versions prior to 7.37.0 , is vulnerable to sensitive data disclosure. The root cause is the failure to perform capability, nonce, or ownership checks before returning event booking and attendee data via the mec_event_bookings and mec_attendees...

CVE-2026-110069 Modern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX Actions

The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment...

CVE-2026-110070 Modern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR

The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types...

CVE-2026-105067

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0...

CVE-2026-105067 WordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0...

EUVD-2026-100988

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0...

CVE-2026-105067

The Modern Events Calendar Lite WordPress plugin (versions before 7.37.0 ) is vulnerable to a Blind SQL Injection flaw. This issue stems from the improper neutralization of special elements used in SQL commands. The vulnerability allows an attacker with low-level privileges to potentially impact ...

CVE-2026-96855

Improper access control in Windows Modern Device Management MDM allows an authorized attacker to perform tampering locally...

CVE-2026-96850

Use of uninitialized resource in Windows Modern Device Management MDM allows an authorized attacker to disclose information locally...

CVE-2026-85833

Use after free in Windows Modern Device Management MDM allows an authorized attacker to elevate privileges locally...

CVE-2026-83697

Time-of-check time-of-use toctou race condition in Windows Modern Device Management MDM allows an authorized attacker to perform tampering locally...

CVE-2026-83656

Missing authentication for critical function in Windows Modern Device Management MDM allows an authorized attacker to perform tampering locally...

CVE-2026-83654

Missing authentication for critical function in Windows Modern Device Management MDM allows an authorized attacker to elevate privileges locally...

CVE-2026-108396

Time-of-check time-of-use toctou race condition in Windows Modern Device Management MDM allows an authorized attacker to elevate privileges locally...

CVE-2026-108133

A release of invalid pointer or reference vulnerability exists in Windows Modern Device Management (MDM) . This flaw allows an authorized attacker to achieve local privilege escalation . The vulnerability is categorized under CWE-763 and carries a High base severity score of 7.8. No specific expl...

CVE-2026-108396

A Time-of-check time-of-use (TOCTOU) race condition exists in Windows Modern Device Management (MDM) . This vulnerability allows an authorized attacker to achieve local privilege elevation . While the documents confirm the vulnerability's existence and its classification under CWE-367 , specific ...

CVE-2026-96850

A vulnerability in Windows Modern Device Management (MDM) involving the use of uninitialized resource (CWE-908) and improper null termination (CWE-170) allows an authorized attacker to disclose information locally . The vulnerability has a CVSS 3.1 base score of 5.5 with a local attack vector and...

CVE-2026-83697

A Time-of-check time-of-use (TOCTOU) race condition exists in Windows Modern Device Management (MDM) . This vulnerability allows an authorized attacker to perform tampering locally . No specific exploit details or remediation steps are provided in the documents.

CVE-2026-83656

A missing authentication vulnerability exists in the Windows Modern Device Management (MDM) component. This flaw allows an authorized attacker to perform tampering locally by accessing a critical function without proper authentication. The CVSS 3.1 score is 4.7 (Medium) , indicating a local attac...