CVE-2026-80122

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access...

EUVD-2026-74766

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access...

CVE-2026-78494

Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application versions contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this to gain unauthorized access , with high impact to confidentiality and integrity but no i...

CVE-2026-79636

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Validation of Certificate with Host Mismatch vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to...

CVE-2026-79636

Dell Secure Connect Gateway (SCG) 5.0 Appliance versions prior to 5.36.00.16 and Application versions prior to 5.36.00.00 contain an Improper Validation of Certificate with Host Mismatch vulnerability. An unauthenticated attacker with remote network access could potentially exploit this flaw to g...

CVE-2026-80123

Dell Secure Connect Gateway 5.0 (SCG) contains a Server-Side Request Forgery (SSRF) vulnerability in both the Appliance and Application editions. An unauthenticated attacker with remote access can exploit this flaw to cause a denial of service . The CVSS 3.1 score is 7.3 (HIGH) , with low impact ...

CVE-2026-80123

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Server-Side Request Forgery SSRF vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service...

CVE-2026-19855

The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's shortcode engine, allowing any visitor to have arbitrary shortcodes registered on the site executed server-side and rendered to every subsequent visitor of t...

EUVD-2026-74723

The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying...

CVE-2026-84908

The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnlloadpayment' AJAX action for both authenticated and unauthenticated wpajaxnopriv users and the underlying addofferproducttocart...

CVE-2026-81022

The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket...

CVE-2026-80339

The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that...

CVE-2026-80340

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the secret that gates access to any order and, through it, that...

CVE-2026-81021

The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers...

CVE-2026-16960

The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records including email addresses and roles and arbitrary site options...

CVE-2026-84222 Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter

The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones...

CVE-2026-84222

CVE-2026-84222 affects the Kirki WordPress plugin versions 6.2.1 through 6.2.5 . The plugin fails to verify whether the requester is authorized to read a post before rendering and returning its content via the kirki_data parameter. This allows unauthenticated users to retrieve the content of non-...

CVE-2026-81021

The SupportCandy WordPress plugin (versions 3.2.9 through 3.5.2) contains a missing authorization check on one of its support-ticket attachment download paths. This allows unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers. T...

CVE-2026-82184 WPLP Cookie Consent < 4.4.2 - Unauthenticated IAB TCF Consent Option Update

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and the code that does so runs on every front-end page load, allowing unauthenticated attackers to overwrite a site-wide option with arbitrary data...

EUVD-2026-74707

The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers...