CVE-2026-16595

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users...

EUVD-2026-54743

The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and...

CVE-2026-16948

The Solace Extra WordPress plugin versions prior to 1.6.1 are vulnerable to improper access control. The root cause is a failure to perform capability checks in several AJAX actions , coupled with the exposure of the protecting nonce on admin pages accessible to low-privileged users. This allows ...

CVE-2026-16590

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users...

CVE-2026-16594

The WP Directory Kit WordPress plugin, in versions before 1.5.5 , is vulnerable to a sensitive information disclosure flaw. The plugin fails to perform adequate authorization or nonce checks on one of its authenticated AJAX actions. This security oversight allows any authenticated user, such as a...

EUVD-2026-54740

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP Directory Kit WordPress plugin before 1.5.5 settings including sensitive API keys and...

CVE-2026-16578

The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, ema...

CVE-2026-16535

The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action...

EUVD-2026-54737

The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, ema...

CVE-2026-16535

The Link Library WordPress plugin version before 7.9.4 is vulnerable to a Reflected Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape a parameter before reflecting it back in an HTTP response. This allows unauthenticated attackers to target users who...

EUVD-2026-54731

The Appointment Hour Booking WordPress plugin before 1.5.88 does not validate a client-supplied booking price against the server-side configured service price, allowing unauthenticated users to submit an arbitrary final price including zero or negative that is stored as the authoritative booking...

EulerOS 2.0 SP11 : haveged (EulerOS-SA-2026-3124)

According to the versions of the haveged packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In src/havegecmd.c, the sockethandler function performs a credential check on the abstract UNIX socket \0/sys/entropy/haveged. However, while it...

PT-2026-69176

Name of the Vulnerable Software and Affected Versions Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection versions prior to 1.4.0 Description An issue exists where a REST API endpoint fails to perform a capability check. This allows unauthenticated attackers to retriev...

EulerOS 2.0 SP11 : cups (EulerOS-SA-2026-3117)

According to the versions of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker ca...

EulerOS 2.0 SP11 : cups (EulerOS-SA-2026-3062)

According to the versions of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker ca...

CVE-2026-70561

TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role...

CVE-2026-69127

Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby...

CVE-2026-69127

Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby...

CVE-2026-69127

Kirby (open-source CMS) has a REST API flaw where, prior to 4.9.5 and from 5.0.0 through 5.5.1, the API error handler can return unsanitized PHP error messages that reveal the full filesystem path of the Kirby installation to unauthenticated API users. The issue affects all sites that have not di...

CVE-2026-69127 Kirby: System path exposure from error messages in the REST API

Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby...