CVE-2026-84146 Xpro Elementor Addons < 1.7.8 - Unauthenticated Draft/Private Product Disclosure via Quick View

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and...

EUVD-2026-70913

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and...

CVE-2026-84146

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin, versions before 1.7.8 , contains a vulnerability where it fails to perform required capability or post-status checks. This allows unauthenticated visitors to retrieve sensitive details—including title, price, SKU, description, and sto...

CVE-2026-17517 Content Views < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure via Views Status Filter

The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has...

CVE-2026-17517

The Content Views WordPress plugin (versions before 4.5.1.2 ) is vulnerable to an unauthenticated non-public post content disclosure. The root cause is a failure to verify if a requesting user is authorized to read the posts returned by a specific view. This allows unauthenticated attackers to ob...

CVE-2026-17517 Content Views < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure via Views Status Filter

The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has...

CVE-2026-85402

creationtimestamp| type| source ---|---|--- 2026-09-04 03:49:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4mhm6vtln7xxe...

CVE-2026-67398

creationtimestamp| type| source ---|---|--- 2026-09-04 01:47:14+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3muntrgu2232e 2026-09-06 11:05:07+00:00| seen| https://bsky.app/profile/cvemon.bsky.social/post/3muttwqaf6n2u...

CVE-2026-85049

creationtimestamp| type| source ---|---|--- 2026-09-04 00:03:34+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117209839276217417 2026-09-04 04:46:19+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260904 2026-09-04 12:40:32+00:00| seen|...

PT-2026-85466

The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment...

CVE-2026-84044: Undefined Security Weakness

The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment...

PT-2026-85657

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Use a private URB for the notification endpoint fcp init notify used mixer-urb, which snd usb mixer status create allocates for the optional UAC2 status interrupt endpoint and mixer.c kills, resubmits and frees. On a...

CVE-2026-85433

creationtimestamp| type| source ---|---|--- 2026-09-03 23:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3munm643azs2p 2026-09-04 00:09:02+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3munodpif7422...

CVE-2026-85048

creationtimestamp| type| source ---|---|--- 2026-09-03 20:00:43+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117208884349943959 2026-09-04 04:46:16+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260904 2026-09-04 12:40:32+00:00| seen|...

CVE-2026-85187

A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function Order::pupdate of the file /rider/orders/controller.php?action=edit&actions=confirm of the component Order Status Update. The manipulation of the argument ID lead...

EUVD-2026-70648

A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function Order::pupdate of the file /rider/orders/controller.php?action=edit&actions=confirm of the component Order Status Update. The manipulation of the argument ID lead...

CVE-2026-85187

itsourcecode Online Medicine Delivery System 1.0 is affected by an SQL injection vulnerability in the Order::pupdate function within the file /rider/orders/controller.php?action=edit&actions=confirm (component: Order Status Update). The vulnerability is triggered by manipulating the ID argument, ...

CVE-2026-85187 itsourcecode Online Medicine Delivery System Order Status Update controller.php pupdate sql injection

A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function Order::pupdate of the file /rider/orders/controller.php?action=edit&actions=confirm of the component Order Status Update. The manipulation of the argument ID lead...

CVE-2026-85187 itsourcecode Online Medicine Delivery System Order Status Update controller.php pupdate sql injection

A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function Order::pupdate of the file /rider/orders/controller.php?action=edit&actions=confirm of the component Order Status Update. The manipulation of the argument ID lead...

CVE-2026-71963

Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user...