EUVD-2026-57746

The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an...

CVE-2026-14332 Ecwid by Lightspeed Ecommerce Shopping Cart < 7.0.9 - Subscriber+ Store Disconnection via 'ec_disconnect' Action

The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an...

CVE-2026-14213 Amelia < 2.4.6 - Provider+ Cross-Customer Appointment Data Disclosure via IDOR

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee provider is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data...

CVE-2026-13328 TLP Food Menu < 6.0.2 - Unauthenticated Reservation Status Modification

The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the...

CVE-2026-19182

Summary of vulnerability details (CVE-2026-19182) : OpenNMS Meridian and Horizon contain an inverted authorization check in the v2 Alarm REST API. A low-privileged authenticated user (ROLE_REST) can acknowledge, escalate, or clear alarms recorded as an arbitrary username, and if also granted ROLE...

CVE-2026-11970: Improper Check for Unusual or Exceptional Conditions

This vulnerability allows a normal non-admin user to disable the Forcepoint One Endpoint SafariExtension and bypass DLP protection in F1E Mac OS before v26.04.5758...

CVE-2026-14332: Missing Authorization

The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an...

CVE-2026-52056

skipchunk off-by-one OOB read in chunked HTTP CRLF check...

CVE-2026-52072

mgtlsclientrecvhello sizet underflow in extlen bounds check / mgtlsclientrecvhello extlen fixed-offset OOB read...

CVE-2026-52048

MQTT v5 properties bounds check uses relative offset against absolute position...

PT-2026-71929

Name of the Vulnerable Software and Affected Versions dromara lamp-cloud versions prior to 5.10.1 Description A path traversal issue exists in the chunk-check endpoint within the FileChunkController.java file. A remote attacker can manipulate the Name argument to perform path traversal, which...

PT-2026-71389

The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the...

PT-2026-71400

The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an...

Linux Distros Unpatched Vulnerability : CVE-2026-70454

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rsync 3.2.0 through 3.2.3 openssl mode and rsync-ssl through 3.4.4 stunnel mode contain a TLS certificate validation vulnerability that allows on-path attackers...

The vulnerability of the Linux operating system’s kernel component tpm allows a hacker to trigger a service failure.

The vulnerability of the tpm component in the Linux operating system’s kernel is related to incorrect checking of the specified index, position, or offset in the input data. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability in the `usb/asix_common.c` component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the usb/asixcommon.c component in the Linux operating system is related to incorrect checking of the specified index, position, or offset in input data. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability in the mac80211/rx.c component of the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability in the mac80211/rx.c component of the Linux operating system’s kernel is related to errors in the implementation of security checks for standard elements. Exploiting this vulnerability can allow an attacker to cause service failures...

WordPress 7.0.2 Cross Site Scripting Checker

A vulnerability checker for a pre-authentication reflected cross site scripting vulnerability in WordPress version 7.0.2. The issue occurs in username handling on failed login attempts and can potentially be chained with administrator interaction and additional functionality to achieve code...

Linux Distros Unpatched Vulnerability : CVE-2026-53784

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabl...

SUSE SLED15: ImageMagick / ImageMagick-config-7-SUSE / etc (SUSE-SU-2026:3586-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3586-1 advisory. This update for ImageMagick fixes the following issue: - CVE-2026-64685: heap buffer over-read in BGR decoder due to...