CVE-2026-105701

The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution (RCE) in all versions up to and including 2.0.66 . The root cause is a missing capability check on the REST API form creation endpoint combined with an unsandboxed Twig environment used for rendering email templates. A...

CVE-2026-105701 ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template

The ACPT Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes ...

CVE-2026-94293 Missing authentication for critical function in the aas-edge-client REST API

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints...

CVE-2026-94293

The aas-edge-client REST API is vulnerable to a missing authentication flaw for critical functions. An unauthenticated remote attacker can perform PATCH requests to modify Asset Administration Shell submodel data and use GET endpoints to read all exposed data. No specific exploit details or remed...

CVE-2026-94293 Missing authentication for critical function in the aas-edge-client REST API

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints...

Exploit for CVE-2026-8206

🛡️ CVE-2026-8206: Unauthenticated Account Takeover Lab Analysi...

CVE-2026-105305: Improper Authentication

A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by ...

PT-2026-106460

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API = 1.6.3 versions...

PT-2026-106362

A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by ...

CVE-2026-105701: Unrestricted Upload of File with Dangerous Type

The ACPT Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes ...

PT-2026-106342

The ACPT Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes ...

CVE-2026-39794: Missing Authorization

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API = 1.6.3 versions...

WP < 7.1.3 - Author+ Sticky Post via REST API

Description WordPress does not correctly verify user capabilities before allowing a post to be set as sticky via the REST API in some cases, which could allow users with Author-level access and above to feature their own posts on the site front page, an action intended to require higher privilege...

Brocade Fabric OS path traversal with USB management privileges (CVE-2026-94580)

: An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS versions before 10.0.1. An authenticated user possessing USB management privileges can manipulate requested target paths to delete arbitrary...

Command Injection vulnerability exists in Brocade Fabric OS REST API management interface

: A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute arbitrary system commands via crafted input parameters...

Stack-based Buffer Overflow in REST API device management component of Brocade Fabric OS

: Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0.1. When processing API request payloads—such as device configuration attributes or port mapping requests—the REST API service fails to properly validate...

Heap-Based Buffer Overflow in Port List Parsing within Brocade Fabric OS

: When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap arrays without enforcing boundary checks on the maximum allowable number of elements. An authenticated administrator can...

Authentication & Authorization Header Spoofing Bypasses Brocade Fabric OS SANnav-Internal REST API Gate

: An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway. The internal gate guarding restricted management endpoints relies exclusively on client-controlled HTTP headers. An authenticated user with any valid REST session can spoof these header...

Authenticated Privilege Escalation via Command Injection in Timezone Configuration Processing

: An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When updating system timezone settings via the REST API or configuration download routines, the system fails to sanitize input values...

Command injection vulnerability exists in the REST API management interface of Brocade Fabric OS (CVE-2026-94581)

: An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions. An attacker with...