CVE-2026-27330

An unauthenticated Broken Access Control vulnerability affects the WordPress plugin Mobile App for WooCommerce in versions ≤ 0.4.62 , as reported by researcher Phat RiO and cataloged by Patchstack. The flaw allows a remote attacker with no prior authentication or user interaction to access protec...

CVE-2026-27330 WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Mobile App for WooCommerce = 0.4.62 versions...

EUVD-2026-66987

Unauthenticated Broken Access Control in Mobile App for WooCommerce = 0.4.62 versions...

CVE-2026-27330 WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Mobile App for WooCommerce = 0.4.62 versions...

EUVD-2026-66986

Subscriber Broken Access Control in Push Notification for Post and BuddyPress = 3.20 versions...

CVE-2026-81279 WordPress Push Notification for Post and BuddyPress plugin <= 3.20 - Broken Access Control vulnerability

Subscriber Broken Access Control in Push Notification for Post and BuddyPress = 3.20 versions...

CVE-2026-81279

The WordPress plugin Push Notification for Post and BuddyPress versions

CVE-2026-81279 WordPress Push Notification for Post and BuddyPress plugin <= 3.20 - Broken Access Control vulnerability

Subscriber Broken Access Control in Push Notification for Post and BuddyPress = 3.20 versions...

Vulnerabilities in Apache CloudStack

Apache has identified several vulnerabilities in Apache CloudStack, specifically in versions 4.12.0.0 through 4.22.1.0. These vulnerabilities include OS command injection in the NAS backup provider plugin, Server-Side Request Forgery SSRF in various modules such as metalink mirror URL resolution...

BIT-NEO4J-ENTERPRISE-2026-1497 Incorrect privilege assignment in composite databases

Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario: an admin that intends to give a user an access to a remote database constituent "namespace.name" will inadvertently grant access to any...

Vulnerabilities found in Ubiquiti’s UniFi products

Ubiquiti has identified vulnerabilities in various UniFi products, including UniFi Protect, UniFi OS, UniFi Network Application, UniFi Connect, UniFi Access Application, UniFi OS Server, UID Enterprise Agent, UniFi Connect Display Cast Pro, UniFi Enterprise Audio/Video Bridge, and UniFi Talk. The...

CVE-2026-81573 Improper Access Control in Local-Only Configuration Commands

If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers. An attacker can read potentially...

CVE-2026-81573

CodeMeter Runtime versions before 8.41a or 9.10 are affected when configured as a server. The configuration command handler fails to enforce network-origin restrictions, allowing arbitrary remote peers to execute commands intended only for local or same-network clients. This enables reading sensi...

CVE-2026-81573 Improper Access Control in Local-Only Configuration Commands

If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers. An attacker can read potentially...

WordPress Dokan plugin < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint vulnerability

Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Dokan versions 5.0.11...

EUVD-2026-66382

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances...

EUVD-2026-66363

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances...

CVE-2026-78139

The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product...

CVE-2026-77990

Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager 5.0.1 - A non-manager can therefore read attendee names, usernames, registration dates and statuses for events they do not manage, including lists belonging to unpublished events...

CVE-2026-19225

The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...