WordPress SureDash authorization issue vulnerability

WordPress SureDash versions 1.12.2 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, which may lead to exploitation of improperly configured access control levels...

VulnCheck KEV: CVE-2026-13756

The WP Grid Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.3.3. This is due to missing authorization and meta key validation in the update handler for the /wp-json/wpgb/v2/metadata REST endpoint. This makes it possible for authenticated...

PT-2026-121287

Missing Authorization vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0...

PT-2026-121479

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet versions 3.3.0 through 3.10.7 PhpSpreadsheet versions prior to 5.10.0 Description Processing attacker-controlled SpreadsheetML XML can lead to entity-expansion denial of service, local file access, or Server-Side Request Forgery...

CrowdStrike Channel File 291: An Engineering Analysis of a Global Endpoint Outage

On July 19, 2024, a CrowdStrike Falcon content update caused Windows systems to crash, affecting about 8.5 million devices according to a Microsoft estimate. The immediate defect was an inconsistency between a detection template that declared 21 inputs and sensor code that supplied 20. A new...

PT-2026-121675

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.9.0 Description The default JWTBearerGrant.get audiences function returns an empty list, which leads JWTBearerGrant.verify claims to only check for the existence of an aud claim without verifying if it matches the...

ROS-20261022-73-0019

The vulnerability of the RDPDR IRP RDP-client FreeRDP module is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability could allow a malicious actor to gain access to read, write, and delete arbitrary files...

PT-2026-121308

Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.5...

ANGLE Library Protected Information Access

The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge relates to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

PT-2026-121312

Name of the Vulnerable Software and Affected Versions ЮKassa для WooCommerce versions prior to 2.17.3 Description An authorization flaw in the yoomoney ЮKassa для WooCommerce plugin allows the exploitation of incorrectly configured access control security levels. Recommendations Update to a versi...

PT-2026-121484

SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitlement by default. An attacker authorized for one tenant can read from or write to another tenant's partition...

Drupal Webform permission and access control issues vulnerability

Drupal Webform versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1 contain a vulnerability related to permission and access control issues. This vulnerability stems from unsafe operations in permission definitions, potentially leading to stored cross-site scripting attacks...

PT-2026-121368

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only...

PT-2026-135082

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality,...

hwk-fr ACF Extended authorization issue vulnerability

The hwk-fr ACF Extended versions 0.9.2.7 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, which may allow attackers to exploit improperly configured access control security levels...

Lotus authorization issue vulnerability

Lotus versions 0.10.2 and earlier contain an authorization issue vulnerability. This vulnerability stems from an authorization bypass in ChangeUserOrganizationView.post, allowing authenticated users to join any organization by providing a UUID. Once attackers obtain other organizations’ UUIDs, th...

WordPress User Profile Builder permission and access control issue vulnerability

WordPress User Profile Builder versions 4.0.4 and earlier contain a privilege escalation vulnerability related to permission handling and access control. This issue stems from improper permission allocation and may lead to privilege escalation...

LXC Incus trust management issue vulnerability

Versions LXC Incus prior to 6.0.3 through 6.0.7, 6.6.0 through 7.0.2, and 7.1.0 through 7.5.0 contain a trust management vulnerability stemming from improper authorization. This allows restricted TLS clients to read bucket keys stored in default projects. Attackers can query the bucket key endpoi...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from an authentication bypass flaw in the PAPI protocol, allowing unauthenticated attackers at adjacent locations to circumvent authentication controls. This could enable attackers to gain administrative access, modify system configurations...

PT-2026-121280

Missing Authorization vulnerability in Kings Plugins MarketKing marketking-multivendor-marketplace-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MarketKing: from n/a through 2.1.72...