CVE-2026-103334

The Five Star Restaurant Reservations WordPress plugin (versions

EUVD-2026-92585

Insertion of Sensitive Information Into Sent Data vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations allows Retrieve Embedded Sensitive Data.This issue affects Five Star Restaurant Reservations: from n/a through 2.7.24...

CVE-2026-103334 WordPress Five Star Restaurant Reservations plugin <= 2.7.24 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations allows Retrieve Embedded Sensitive Data.This issue affects Five Star Restaurant Reservations: from n/a through 2.7.24...

CVE-2025-12399

Alex Reservations: 스마트 레스토랑 예약 = 2.2.3 - 인증된 관리자+ 임의 파일 업로드 WordPress Alex Reservations 플러그인2.2.3 이하 버전에는 인증된 WordPress 관리자가 서버에 악성 PHP 파일을 업로드할 수 있게 하는 임의 파일 업로드 취약점이 존재하며, 이로 인해 원격 코드 실행으로 이어질 수 있습니다. TL;DR 익스플로잇 원격 공격자가 shell.php를 업로드하고 원격 코드를 실행하는 과정을 보여주는 POC CVE-2025-12399.py가 제공됩니다: python...

WordPress Five Star Restaurant Reservations plugin <= 2.7.24 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Five Star Restaurant Reservations versions = 2.7.24...

CVE-2026-79348

KitchenAsty through 0.3.0 contains a broken object level authorization IDOR vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or role check, and the getReservation handler in...

CVE-2026-79348

KitchenAsty through 0.3.0 contains a broken object level authorization IDOR vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or role check, and the getReservation handler in...

CVE-2026-79348

KitchenAsty through 0.3.0 contains a broken object level authorization IDOR vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or role check, and the getReservation handler in...

CVE-2026-79348

KitchenAsty versions up to and including 0.3.0 is vulnerable to a broken object level authorization (IDOR) flaw in the reservations API. Specifically, the GET /api/reservations/:id endpoint in packages/server fails to perform ownership or role checks. The getReservation handler in packages/server...

CVE-2026-79348: Authorization Bypass Through User-Controlled Key

KitchenAsty through 0.3.0 contains a broken object level authorization IDOR vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or role check, and the getReservation handler in...

EUVD-2026-89425

KitchenAsty through 0.3.0 contains a broken object level authorization IDOR vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or role check, and the getReservation handler in...

CVE-2026-79348

KitchenAsty through 0.3.0 contains a broken object level authorization IDOR vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or role check, and the getReservation handler in...

WordPress Five Star Restaurant Reservations plugin < 2.7.23 - Unauthenticated Payment Bypass and Booking Confirmation via IDOR vulnerability

Unauthenticated Payment Bypass and Booking Confirmation via IDOR vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Five Star Restaurant Reservations versions 2.7.23...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38409)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the delStaticDhcpRules function. Attackers can exploit this vulnerability by sending a specially crafted PO...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerabilities have been resolved: btrfs: Do not free the qgroup space unless specified. Boris noticed during his simple quota testing that there was a leak caused by Sweet Tea’s change to the subvol create function, which would stop a transaction commit. This...

CVE-2026-51718

Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove static DHCP reservations via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51718: Improper Access Control

Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove static DHCP reservations via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68677

Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove static DHCP reservations via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: btrfs: Skipping the “reserved bytes” warning after unmounting after a log cleanup failure. After the recent changes made by commit c2e39305299f01 “btrfs: clearing the extent buffer when writing fails” and its follow-up fix,...

CVE-2026-15229 Pinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Arbitrary Booking Price Manipulation

The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price including zero and, by selecting a specific payment method, obtain an instantly-approved reservation...