EUVD-2026-68065

The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans...

EUVD-2026-68060

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other...

EUVD-2026-68063

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...

EUVD-2026-68052

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media item...

CVE-2026-18234 MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid...

CVE-2026-18233

CVE-2026-18233 affects the MStore API WordPress plugin before 4.21.1 . The plugin fails to verify that an order targeted by one of its delivery endpoints actually belongs to the requester. This allows any authenticated user—even those with the lowest Subscriber role—to mark arbitrary orders as co...

CVE-2026-18233 MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made...

EUVD-2026-68009

Incorrect access control in the getWiFiApcliScan function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger wireless scans and retrieve AP-client scan results via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68005

Incorrect access control in the getTracerouteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain traceroute diagnostic logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68006

Incorrect access control in the getCloudSrvCheckStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud firmware check status information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68007

Incorrect access control in the getPortForwardRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68008

Incorrect access control in the getTelnetCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain Telnet service enablement status information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-66220

Kimai versions before 2.56.0 fail to restrict the config Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configuration keys. Attackers with admin privileges can upload malicious templates to exfiltrate server-wide secrets including LDAP bind...

EUVD-2026-66394

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin on the acting account rather than verifying whether the specific API key carri...

Linux Distros Unpatched Vulnerability : CVE-2026-37236

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP- Method-Override header in ServeMux.ServeHTTP without...

Linux Distros Unpatched Vulnerability : CVE-2026-55584

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts...

CVE-2026-51661

Incorrect access control in the getPortForwardRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51665

Incorrect access control in the getTracerouteCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain traceroute diagnostic logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51663

Incorrect access control in the getWiFiApcliScan function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger wireless scans and retrieve AP-client scan results via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51662

Incorrect access control in the getCloudSrvCheckStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud firmware check status information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...