CVE-2026-67990

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management...

CVE-2026-66700

Unauthenticated Cross Site Scripting XSS in Smart Online Order for Clover = 1.6.1 versions...

CVE-2026-66656

Unauthenticated Local File Inclusion in Foton Core = 1.1.1 versions...

CVE-2026-66469

Unauthenticated Broken Access Control in Arvow AI SEO Writer = 1.5.3 versions...

CVE-2026-66463

Unauthenticated Sensitive Data Exposure in iCARRY = 2.9 versions...

CVE-2026-66462

Unauthenticated Sensitive Data Exposure in WooCommerce Appointments = 5.3.8 versions...

CVE-2026-66436

Unauthenticated SQL Injection in Active Products Tables for WooCommerce = 1.1.1 versions...

CVE-2026-61979

Unauthenticated Privilege Escalation in SAML SP Single Sign On = 5.4.3 versions...

CVE-2026-61967

Unauthenticated Privilege Escalation in miniorange otp verification = 5.5.1 versions...

CVE-2026-28189

Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...

CVE-2026-28185

Unauthenticated Broken Authentication in Log in with Google = 1.4.2 versions...

CVE-2026-28176

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

CVE-2026-28155

Unauthenticated Insecure Direct Object References IDOR in Do Lasso = 358 versions...

CVE-2026-28142

Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...

CVE-2026-28148

Unauthenticated Bypass Vulnerability in Headless Single Sign On = 1.6 versions...

CVE-2026-27543

Unauthenticated Privilege Escalation in MStore API = 4.20.0 versions...

Exploit for Eval Injection in Langflow

CVE-2026-33017 — Langflow Unauthenticated RCE PoC 면책 조항...

EUVD-2026-57916

Unauthenticated Broken Access Control in User Registration = 5.2.6 versions...

EUVD-2026-57915

Unauthenticated Broken Access Control in InstaWP Connect = 0.1.3.7 versions...

CVE-2026-73403

The CVE-2026-73403 entry concerns the WordPress User Registration plugin (versions ≤ 5.2.6) with unauthenticated broken access control in its registration flow. Affected software: WordPress User Registration plugin; vulnerable component: registration/authentication logic described as enforcing br...