vimana-framework

Descripción general Vimana es un framework de seguridad modular para auditar APIs de Python y aplicaciones web. La arquitectura basada en plugins permite a los profesionales de seguridad evaluar, fuzzear y analizar proyectos de Python mediante técnicas automatizadas y manuales. Capacidades...

CVE-2026-106510

A flaw was found in plugin-techdocs-node. An authenticated attacker with permissions to register catalog entities can achieve arbitrary code execution by submitting a crafted documentation configuration file. When the documentation is built, the malicious markdown extensions setting triggers...

tenet

Tenet - Un Explorador de Trazas para Ingenieros Inversos Descripción general Tenet es un plugin para IDA Pro que permite explorar trazas de ejecución. El objetivo de este plugin es proporcionar controles más naturales y humanos para navegar por trazas de ejecución contra un binario dado. La base ...

CVE-2026-94246

The Wallet System for WooCommerce WordPress plugin, versions before 2.8.0 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The application fails to verify that the wallet account specified in a withdrawal submission belongs to the authenticated user. This allows any authenticat...

EUVD-2026-94753

The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbers, allowing an administrator of one site on a multisite network to disclose the phone numbers of users who belong to...

CVE-2026-86828

The BackWPup WordPress plugin (versions prior to 5.7.7 ) is vulnerable to a path traversal flaw during the backup restore process. When the plugin's fallback archive library is utilized, it fails to properly restrict the destination path of extracted files. This allows high-privileged users to wr...

CVE-2026-94244

The Wallet System for WooCommerce WordPress plugin, in versions before 2.8.0 , is vulnerable to a store-wide wallet transaction disclosure. The root cause is a lack of capability checks where the plugin relies on a token obtainable by any authenticated user from a front-end page to generate repor...

CVE-2026-86828 BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback

The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code...

CVE-2026-86827 BackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.php

The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of i...

EUVD-2026-94748

The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of i...

CVE-2026-86826

The BackWPup WordPress plugin, in versions before 5.7.7 , fails to properly restrict web access to the working directory utilized during backup restores. On webservers that do not honor .htaccess rules, such as NGINX , unauthenticated attackers can download full backup archives left behind by int...

CVE-2026-105197 LatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOR

The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to act on the specific record targeted for deletion, allowing an authenticated user with a record-scoped staff role to irreversibly delete any order, customer, or transaction on th...

CVE-2026-105260 Database Addon For WPForms < 1.1.1 - Arbitrary Form Entry Deletion via CSRF

The Database Addon For WPForms wpforms entries WordPress plugin before 1.1.1 does not verify the CSRF nonce when the field is omitted and performs no capability check of its own, allowing attackers to delete arbitrary stored form entries by tricking a logged-in administrator into loading a crafte...

CVE-2026-86826 BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory on NGINX

The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive database dump and site...

WordPress Appointment Booking Plugin plugin < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion vulnerability

Agent+ Arbitrary Order, Customer and Transaction Deletion vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin LatePoint versions 5.6.5...

WordPress Appointment Booking Plugin plugin < 5.7.3 - Unauthenticated Customer PII Disclosure vulnerability

Unauthenticated Customer PII Disclosure vulnerability discovered by Vũ Quang Huy in WordPress Plugin LatePoint versions 5.7.3...

WordPress Appointment Booking Plugin plugin < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification vulnerability

Agent+ Cross-Agent Data Disclosure and Modification vulnerability discovered by Artus KG in WordPress Plugin LatePoint versions 5.6.9...

EUVD-2026-94770

The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summary, letting an unauthenticated visitor retrieve any customer's name, contact details and order...

EUVD-2026-94768

The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authenticated user holding the LatePoint Agent role, normally restricted to their own records, to read and modify other agents' profile da...

EUVD-2026-94769

The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to act on the specific record targeted for deletion, allowing an authenticated user with a record-scoped staff role to irreversibly delete any order, customer, or transaction on th...