CVE-2026-82486 SiteServer SSCMS Agent Installation Workflow access control

A vulnerability was found in SiteServer SSCMS 7.4.0. Affected by this issue is some unknown functionality of the component Agent Installation Workflow. Performing a manipulation of the argument SecurityKey results in improper access controls. Remote exploitation of the attack is possible. The...

CVE-2026-82486

A vulnerability in SiteServer SSCMS 7.4.0 affects the Agent Installation Workflow component, where improper access controls are triggered by manipulating the SecurityKey argument. The attack is remotely exploitable but rated as high complexity and difficult to execute . CVSS 3.1 scores it 5.0 (Me...

CVE-2026-82486 SiteServer SSCMS Agent Installation Workflow access control

A vulnerability was found in SiteServer SSCMS 7.4.0. Affected by this issue is some unknown functionality of the component Agent Installation Workflow. Performing a manipulation of the argument SecurityKey results in improper access controls. Remote exploitation of the attack is possible. The...

EUVD-2026-68160

The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute...

PT-2026-83571

AVideo current commit e01e41ecc and earlier exposes stream credentials through the plugin/Live/view/Live restreams/getLiveKey.json.php endpoint. Supplying a 'token' request parameter waives both the Live::canRestream access gate and the restream ownership check, causing the endpoint to return any...

PT-2026-83584

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.12 Description Broken access control in profile function.php allows authenticated users with low privileges to view the future role memberships of other users. This is achieved by bypassing profile-level...

PT-2026-83577

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard introduced in GHSA-c8r8-95hg-mp34 to the /history/path and /repo/diff/path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can...

PT-2026-83583

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.12 Description The software fails to enforce login-only module restrictions within the RSS feed endpoints for the forum and announcements modules. This allows unauthenticated attackers to retrieve forum topics and...

Exploit for Improper Access Control in Oracle Http_Server

No d...

CVE-2026-81346

The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans...

CVE-2026-81200

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...

CVE-2026-80311

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other...

CVE-2026-18233

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made...

EUVD-2026-68065

The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans...

EUVD-2026-68060

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other...

EUVD-2026-68063

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...

EUVD-2026-68058

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their ow...

EUVD-2026-68052

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media item...

CVE-2026-18234 MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid...

CVE-2026-18233

The MStore API WordPress plugin, in versions before 4.21.1 , contains a vulnerability where it fails to verify if a targeted order belongs to the requester when accessing certain delivery endpoints. This allows any authenticated user , including those with Subscriber privileges, to mark arbitrary...