PT-2026-69346

Name of the Vulnerable Software and Affected Versions Customer Reviews for WooCommerce versions prior to 5.116.0 Description The plugin fails to perform nonce a unique token used to prevent cross-site request forgery or capability checks on several settings-related AJAX actions. This allows users...

CVE-2025-32736: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions...

CVE-2026-17021: Missing Authorization

The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings...

PT-2026-69362

Name of the Vulnerable Software and Affected Versions Salon Booking System WordPress plugin versions prior to 10.30.34 Description The plugin fails to properly restrict access to certain booking-modification AJAX actions and does not verify the ownership of the targeted booking. This allows...

CVE-2026-72578: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator...

PT-2026-69989

Name of the Vulnerable Software and Affected Versions PingFederate versions prior to 13.1 Description Cross-Site Request Forgery CSRF weaknesses in the Administrative Console may allow actors to perform unauthorized actions. This occurs when administrators with active sessions are triggered to...

PT-2026-69443

Name of the Vulnerable Software and Affected Versions WP Umbrella versions 2.24.2 through 2.26.2 Description A Cross-Site Request Forgery CSRF flaw exists in WP Umbrella. This issue allows an attacker to induce a user to perform actions they did not intend to do by tricking them into clicking a...

CVE-2025-30238: Incorrect Authorization

In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may perform administrative actions such as creating privileged accounts or modifying critical configuration settings...

SUSE CVE-2026-64531

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nlalen field is u16. Commit a1e64addf3ff "net: openvswitch: remove misbehaving actions length check" allowed the...

CVE-2026-18603 Cancel Order & Request Woocommerce < 1.3.4.34 - Unauthenticated Order Content Disclosure via Reorder AJAX Actions

The PiWeb Cancel order / Refund request for WooCommerce WordPress plugin before 1.3.4.34 does not have authorization or ownership checks when adding the contents of a previous order to the cart, allowing unauthenticated users to disclose the contents of other customers' orders, as well as to clea...

ShadowAI-Watch: Bringing AI Agent Activity Out of the Shadows

AI agents are rapidly becoming part of everyday development. They operate inside terminals, IDEs, and internal workflows, helping users write code, troubleshoot problems, and automate repetitive tasks. But their capabilities can extend far beyond what users see in the chat interface or terminal...

CVE-2026-16965: Cross-Site Request Forgery (CSRF)

The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber and, via CSRF, any logged-in user to update post meta on arbitrary posts and to deactivate the site's active templates...

CVE-2026-16948

The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and...

CVE-2026-16948 Solace Extra < 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wide Nonce Exposure

The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and...

EUVD-2026-54743

The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and...

EUVD-2026-54741

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users...

EUVD-2026-54730

The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via type juggling and perform privileged actions such as modifying subscriber records and sending emails, when the optional API ha...

CVE-2026-16948: Improper Access Control

The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and...

CVE-2026-16269: Improper Authentication

The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via type juggling and perform privileged actions such as modifying subscriber records and sending emails, when the optional API ha...

CVE-2026-16589: Improper Neutralization of Special Elements used in an SQL Command

The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks, allowing any authenticated user such as a Subscriber to perform SQL injection...