EUVD-2026-64639

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

CVE-2026-77116 Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup Disclosure via Preview

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

CVE-2026-77116 Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup Disclosure via Preview

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

CVE-2026-77116

The Brave Popup Builder WordPress plugin (slug: brave-popup-builder ) is vulnerable to a broken access control issue in versions through 0.8.5 . An authenticated user with Subscriber or WooCommerce Customer privileges can read restricted popup content by providing a specific post ID in the URL. T...

EUVD-2026-64636

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...

CVE-2026-14853

The WooCommerce Bookings WordPress plugin, in versions before 3.9.0 , is vulnerable to unauthorized action execution. The plugin fails to perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token. This allows users with Subscriber-level acces...

CVE-2026-14853 WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing Authorization

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...

Exploit for CVE-2026-78122

CVE-2026-78122 — Proof of Concept Tecnativa docker-socket-...

owasp-top10-2025-labs

OWASP Top 10:2025 — Labs Repositorio de portafolio: replica y...

EUVD-2026-64603

docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to /containers/id/archive, /containers/id/export, /containers/id/logs, and /containers/id/top to read arbitrary files a...

SUSE CVE-2026-74595

In the Linux kernel, the following vulnerability has been resolved: fscrypt: use the mount idmap for the owner check in fscryptioctlsetpolicy fscryptioctlsetpolicy calls inodeownerorcapable with &nopmntidmap before allowing an encryption policy to be set, instead of the idmap of the mount the ioc...

PT-2026-79763

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

A Study of Bluetooth Access Control Based on NFT Soft Pairing

This paper proposes a Non-Fungible Token NFT soft pairing framework for Bluetooth service access control. Unlike conventional Bluetooth systems where pairing implicitly grants persistent service access, the proposed approach decouples native Bluetooth pairing from authorization without modifying...

CVE-2026-78122

docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to /containers/id/archive, /containers/id/export, /containers/id/logs, and /containers/id/top to read arbitrary files a...

CVE-2026-78122

docker-socket-proxy (Tecnativa) through 0.5.0 has an insufficient access control granularity flaw in the /containers Docker API namespace. When the CONTAINERS environment variable is set, read endpoints (/containers/{id}/archive, /export, /logs, /top) are not properly gated, allowing an unauthent...

CVE-2026-78122 docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystems

docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to /containers/id/archive, /containers/id/export, /containers/id/logs, and /containers/id/top to read arbitrary files a...

CVE-2026-78122 docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystems

docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to /containers/id/archive, /containers/id/export, /containers/id/logs, and /containers/id/top to read arbitrary files a...

CVE-2026-78122 docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystems

docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to /containers/id/archive, /containers/id/export, /containers/id/logs, and /containers/id/top to read arbitrary files a...

SUSE CVE-2026-72815

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...

SUSE CVE-2026-72816

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...