CVE-2026-79706

The Breeze Cache WordPress plugin before 2.5.13 does not sanitise a value taken from the request before using it to build the paths of the files it caches, allowing unauthenticated attackers to create files at arbitrary locations on the server, outside the intended cache directory...

CVE-2026-77701

The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site...

CVE-2026-14567

The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators...

CVE-2026-78072 Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded < 5.6.1

Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded 5.6.1...

Multiple vulnerabilities in GROWI

Overview GROWI provided by GROWI, Inc. contains multiple vulnerabilities listed below: Authorization bypass through user-controlled key in the bookmark folder APIs CWE-639 - CVE-2026-53620 Incorrect authorization in the bookmark listing APIs CWE-863 - CVE-2026-68951 CVE-2026-53620 Masashi Kawamot...

CVE-2026-77701

The WCFM Marketplace WordPress plugin before 3.8.2 fails to correctly verify that the requester of a refund owns the order. This allows unauthenticated users to create refund requests against any guest checkout order on the affected site. The root cause is an insufficient authorization check on t...

CVE-2026-77701 WCFM Marketplace < 3.8.2 - Unauthenticated Refund Request Creation on Guest Orders

The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site...

EUVD-2026-67564

The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's' parameter of the Advanced Search REST endpoint in all versions up to, and including, 4.10.1 due to insufficient input sanitization and output escaping. The REST endpoint at...

EUVD-2026-67293

Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote attacker to enable administrative services that should be restricted. Successful exploitation may permit unauthorized access to the device...

EUVD-2026-67277

Ebyte device web management interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated remote attacker could access sensitive configuration information, modify device settings, or disrupt availability...

EUVD-2026-67312

PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network to be publicly accessible, with or without an account...

CVE-2026-78239

Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote attacker to enable administrative services that should be restricted. Successful exploitation may permit unauthorized access to the device...

CVE-2026-73125

Ebyte device web management interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated remote attacker could access sensitive configuration information, modify device settings, or disrupt availability...

CVE-2026-71187

The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device...

EUVD-2026-67360

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /openndspreauth/ endpoint because of libopennds.sh...

CVE-2026-51625

CVE-2026-51625 is an incorrect access control flaw in the getWiFiEasyCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi over the network to retrieve sensitive Wi-Fi configuration data, inclu...

VulnCheck KEV: CVE-2026-32566

Unauthenticated Privilege Escalation in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

CVE-2026-51617

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) suffers from incorrect access control in the getSysStatusCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to disclose sensitive data including operation mode, firmware version, serial number, WAN/LAN IP ...

PT-2026-83316

Name of the Vulnerable Software and Affected Versions JFrog Artifactory versions prior to 7.111.21 JFrog Artifactory versions prior to 7.117.28 JFrog Artifactory versions prior to 7.125.20 JFrog Artifactory versions prior to 7.133.29 JFrog Artifactory versions prior to 7.146.38 JFrog Artifactory...

CVE-2026-51645

CVE-2026-51645 is an incorrect access control flaw in the getPasswordCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015 . An unauthenticated attacker can obtain the administrative username by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CVSS 3.1 score is 9.8 (Critical) (AV:...