CVE-2026-64637

Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account...

CVE-2026-64636

CVE-2026-64636 affects Plesk Obsidian up to version 18.0.80 on Linux and Windows. An SQL injection vulnerability allows an authenticated user to read arbitrary data from the panel database. According to the connected sources, the issue has a CVSS v3.1 base score of 7.7 (HIGH), with attack vector ...

CVE-2026-66058

CVE-2026-66058 affects the Frappe framework. Prior to versions 16.20.0 and 15.112.0 , an authenticated user could gain unrestricted access to the Document Follow API (update_follow). The issue is fixed in those versions. The available sources confirm the vulnerable behavior as an unauthorized/unr...

CVE-2026-66058 Frappe: Unrestricted access to a Document Follow API

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API updatefollow is possible for an authenticated user. This issue is fixed in versions 16.20.0 and 15.112.0...

CVE-2026-14644

Nexus Repository 3 contains a privilege escalation vulnerability in the REST privileges API. An authenticated user who can manage privileges can elevate to full administrator under certain role configurations by abusing a type-confusion flaw in the privilege update endpoint. The CVE entry describ...

CVE-2026-14644 Nexus Repository 3 - Privilege Escalation

Nexus Repository 3 contained a privilege escalation vulnerability in the REST privileges API. An authenticated user with permission to manage privileges could, under certain role configurations, escalate their own access to full administrator by exploiting a type-confusion flaw in the privilege...

CVE-2026-37171

A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one tenant to access sessions, data, and endpoints of another tenant...

CVE-2026-54211

Tobit Laboratories AG TeamDavid's Webbox application’s endpoint “//serverClientclose.html” is vulnerable to a buffer overflow vulnerability in multiple form data parameters. By submitting excessively long values in these parameters, an authenticated attacker can trigger a server crash, resulting ...

EUVD-2026-54442

Tobit Laboratories AG TeamDavid's Webbox application’s endpoint “//serverClientclose.html” is vulnerable to a buffer overflow vulnerability in multiple form data parameters. By submitting excessively long values in these parameters, an authenticated attacker can trigger a server crash, resulting ...

EUVD-2026-54432

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a local file inclusion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an '@@attach' command in the form field 'scjob', files can be attached to a message, which can then be downloaded by an authenticated user....

CVE-2026-16039

The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information...

CVE-2026-15214

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information the subscribed product, status, and dates by...

CVE-2026-15361

The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks...

EUVD-2026-54387

The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information...

CVE-2026-16039 MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR

The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information...

CVE-2026-15361 Content Views < 4.5 - Subscriber+ SQL Injection via preview_request

The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks...

EUVD-2026-54383

The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks...

CVE-2026-15361

The CVE relates to the Content Views WordPress plugin prior to version 4.5. It does not perform a required capability check on one of its AJAX actions and fails to sanitize attacker-supplied data before using it in a SQL query. This combination allows any authenticated user, including Subscribers...

CVE-2026-15214

The CVE-2026-15214 entry affects the WooCommerce Subscriptions plugin for WordPress (pre-2.0.1). The vulnerability is an IDOR: an authenticated user can view another customer’s subscription details (subscribed product, status, dates) because the plugin does not verify ownership before rendering t...

EUVD-2026-54379

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information the subscribed product, status, and dates by...