CVE-2026-103239: Improper Access Control

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any...

CVE-2026-103548: Storing Passwords in a Recoverable Format

Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user...

CVE-2026-103231: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected element is the function mysqliquery of the file User/cancel.php of the component Order Cancellation. The manipulation of the argument ID leads to sql injectio...

CVE-2026-100263: Improper Neutralization of Input During Web Page Generation

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible...

CVE-2026-97259: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4...

CVE-2026-62084: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jeff Starr User Submitted Posts allows Stored XSS. This issue affects User Submitted Posts: from n/a through 20260810...

CVE-2026-102587: Observable Response Discrepancy

A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure...

CVE-2026-75824: Improper Access Control

The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creating an account, allowing unauthenticated users to create accounts on sites where registration is disabled. The created account receives the site's default role...

CVE-2026-75823: Improper Privilege Management

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...

PT-2026-103023

The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creating an account, allowing unauthenticated users to create accounts on sites where registration is disabled. The created account receives the site's default role...

PT-2026-103296

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jeff Starr User Submitted Posts allows Stored XSS. This issue affects User Submitted Posts: from n/a through 20260810...

PT-2026-103022

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is...

PT-2026-103095

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not...

PT-2026-103101

Name of the Vulnerable Software and Affected Versions Post Views Stats Counter versions prior to 1.1.8 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts through the User-Agent heade...

PT-2026-103310

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.18991 Description Stored HTML injection is possible through the User-Agent header. Recommendations Update to version 2026.2.18991...

PT-2026-103525

Name of the Vulnerable Software and Affected Versions Itron MV-90 xi version 3.0 Description Passwords and password histories are stored improperly in the configuration file, allowing attackers to decode them and gain unauthorized access to the MV-90 application as any user. Recommendations At th...

CVE-2026-83560: Exposure of Sensitive Information to an Unauthorized Actor

The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data id, username, email address and registration date of registered...

PT-2026-103453

Name of the Vulnerable Software and Affected Versions Zammad versions 6.3.0 through 6.5.4 Description A session hijack issue allows for remote code execution as the zammad user. Approximately 12,000 instances have been identified globally. Recommendations At the moment, there is no information...

PT-2026-103467

Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This issue affects MediaWiki WikiLambda extension: 1.46...

CVE-2026-103446: Authorization Bypass Through User-Controlled Key

Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This issue affects MediaWiki WikiLambda extension: 1.46...