CVE-2026-58041

A flaw was found in Node.js's node:sqlite module. This vulnerability allows a previously used database statement, which should have been reset, to be re-executed with new parameters. This could lead to unintended data modifications or integrity issues within the application. Mitigation Applicatio...

github.com/moby/buildkit: BuildKit: File escape vulnerability allows unauthorized file modification

A flaw was found in BuildKit, a toolkit for converting source code to build artifacts. A malicious client with valid permissions to access the BuildKit control API can craft a special upload request. This request allows files to escape from the BuildKit-controlled state directory, potentially...

CVE-2026-66407

CVE-2026-66407 affects DEEBOT PRO M1 and PRO K1VAC, where authentication in WebSocket communications is improperly implemented. According to sources, the WebSocket private key may be retrieved via a man-in-the-middle analysis of traffic, allowing an attacker to analyze and potentially alter commu...

CVE-2026-18200

The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, allowing authenticated users, with Subscriber-level access and above, to modify the profile details of arbitrary users, including administrators...

CVE-2026-15238

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account Subscriber and above to modify or overwrite the personal data of any customer by supplying an arbitrary...

EUVD-2026-54996

The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, allowing authenticated users, with Subscriber-level access and above, to modify the profile details of arbitrary users, including administrators...

CVE-2026-18200

The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, allowing authenticated users, with Subscriber-level access and above, to modify the profile details of arbitrary users, including administrators...

CVE-2026-14211 Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR

The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee provider is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any...

CVE-2026-14211 Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR

The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee provider is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any...

CVE-2026-14211

The Booking for Appointments and Events Calendar (Amelia Pro) WordPress plugin before version 9.7 is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is a failure to verify that an authenticated employee (provider) is authorized to access a specific customer's record. An ...

CVE-2026-17021 Salon Booking System – Free Version < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering

The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings...

CVE-2026-17021

The Salon Booking System WordPress plugin through 10.30.33 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings...

CVE-2026-15238 Hotel Booking Lite < 6.2.3 - Subscriber+ Customer Data Modification via IDOR

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account Subscriber and above to modify or overwrite the personal data of any customer by supplying an arbitrary...

CVE-2026-15238

The MotoPress Hotel Booking (and Hotel Booking Lite ) WordPress plugin, in versions before 6.2.3 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The software fails to verify record ownership when updating customer records, which allows any authenticated user with a low-privileged ...

CVE-2026-15238

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account Subscriber and above to modify or overwrite the personal data of any customer by supplying an arbitrary...

PT-2026-69362

Name of the Vulnerable Software and Affected Versions Salon Booking System WordPress plugin versions prior to 10.30.34 Description The plugin fails to properly restrict access to certain booking-modification AJAX actions and does not verify the ownership of the targeted booking. This allows...

PT-2026-69604

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vivid media driver where the vivid update format cap and vivid update format out functions are called without verifying if the capture or output queues are busy...

Splunk Enterprise REST API Unauthenticated Access Code Execution

The vulnerability of the REST API interface implementation of the Splunk Enterprise platform for operational analysis is related to an incorrect limitation on the path name to the $SPLUNKHOME/etc/ directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access t...

CVE-2026-18603

The PiWeb Cancel order / Refund request for WooCommerce WordPress plugin before 1.3.4.34 does not have authorization or ownership checks when adding the contents of a previous order to the cart, allowing unauthenticated users to disclose the contents of other customers' orders, as well as to clea...

CVE-2026-18603 Cancel Order & Request Woocommerce < 1.3.4.34 - Unauthenticated Order Content Disclosure via Reorder AJAX Actions

The PiWeb Cancel order / Refund request for WooCommerce WordPress plugin before 1.3.4.34 does not have authorization or ownership checks when adding the contents of a previous order to the cart, allowing unauthenticated users to disclose the contents of other customers' orders, as well as to clea...