CVE-2026-76006

Photo Gallery by Ays (WordPress plugin) versions up to and including 6.8.2 are vulnerable to SQL Injection via the 's' parameter . The root cause is insufficient escaping and lack of query preparation on user-supplied input across two execution paths: $wpdb->get_var() in record_count() and $wp...

CVE-2026-17589 Shopping Cart & eCommerce Store <= 5.9.2 - Authenticated (Administrator+) SQL Injection via 'product_order' Parameter

The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'productorder' parameter in all versions up to, and including, 5.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

PT-2026-84112

The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the export order csv AJAX action in versions up to, and including, 4.4.4. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

PT-2026-84415

A privilege escalation vulnerability exists in the API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to gain administrative privileges leading to complete compromise of the HPE Networking Fabric Composer host...

CVE-2026-79744 MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29, MCPHub's PUT /api/system-config endpoint handler updateSystemConfig performs no authorization check. It is...

CVE-2026-79745 MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts and...

CVE-2026-79747

MCPHub , a hub for centrally managing and orchestrating multiple MCP servers/APIs, is vulnerable to SSRF prior to version 1.0.32. An authenticated non-admin user can register a server pointing at an arbitrary URL, causing the hub to issue server-side requests with no egress filtering (loopback, R...

CVE-2026-82651

SiYuan before v3.8.1 fails to apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*path endpoints in kernel/server/serve.go. Although these routes require admin authentication , they construct file paths independently, allowing an authentica...

CVE-2026-82651 SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard introduced in GHSA-c8r8-95hg-mp34 to the /history/path and /repo/diff/path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can...

WordPress WP Ultimate CSV Importer plugin < 9.0 - Admin+ SQLi vulnerability

Admin+ SQLi vulnerability discovered by Jaan Buerms in WordPress Plugin WP Ultimate CSV Importer versions 9.0...

WordPress User Profile Builder plugin < 4.0.1 - Admin+ PHP Object Injection vulnerability

Admin+ PHP Object Injection vulnerability discovered by Vivien LEBAS in WordPress Plugin Profile Builder versions 4.0.1...

GHSA-J5G3-42WP-GQM3 Snipe-IT has an Improper Privilege Management issue

Impact The update method in UsersController passes the permission request field unconditionally to NormalizePermissionsPayloadAction, which returns an empty array when the field is absent. The result is passed to PreserveUnauthorizedPrivilegedPermissionsAction, which selectively restores only the...

Snipe-IT has an Improper Privilege Management issue

Impact The update method in UsersController passes the permission request field unconditionally to NormalizePermissionsPayloadAction, which returns an empty array when the field is absent. The result is passed to PreserveUnauthorizedPrivilegedPermissionsAction, which selectively restores only the...

CVE-2026-19423

The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the site's registered role names rather than against the form's own allow-list, allowing unauthenticated...

CVE-2026-76581

CVE-2026-76581 is a Critical (CVSS 9.8) unauthenticated Authentication Bypass in the WPMU DEV Dashboard plugin for WordPress (≤ 5.0.1 , ~350,000 installs). The root cause is HMAC canonicalization confusion between two unauthenticated AJAX actions: wdpsso_step1 signs an unseparated concatenation o...

EUVD-2026-67289

The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality...

CVE-2026-39070

WordPress plugin Bit Assist before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role admin can exploit this to redirect user to malicious site or control the account...

PT-2026-83096

Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to execute arbitrary code by uploading a malicious plugin tarball. The server calls eval on plugin JavaScript files without sandboxing in the main Node.js process...

CVE-2026-76945

CVE-2026-76945 affects the Ebyte NE2-D11 device. The root cause is client-managed authentication tokens without sufficient server-side validation , allowing an attacker to replay or manipulate tokens to gain unauthorized access to administrative functionality . The primary impact is confidentiali...

CVE-2026-76945 Ebyte NE2-D11 Use of Client-Side Authentication

The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality...