WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ayukiab in WordPress Plugin Strong Testimonials versions = 3.3.12...

CVE-2026-55467

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and...

CVE-2026-55467 CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and...

CVE-2026-55467 CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and...

CVE-2026-55467

The OpenPrinting CUPS system (prior to version 2.4.20 ) is vulnerable to a control-character injection flaw in the cupsdCreateJob option-string builder located in scheduler/job.c. The destination-uri and pre-dial-string values from a configured fax queue are mapped to phone and faxPrefix options ...

CVE-2026-55467 CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and...

EUVD-2026-102204

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and...

CVE-2026-55467

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and...

Exploit for CVE-2026-108578

CVE-2026-108578 — Neterbit NW-431F unauthenticated SMS disclos...

IBM i Permission Licensing and Access Control Vulnerabilities

Versions of IBM i 7.3, 7.4, 7.5, and 7.6 have vulnerabilities related to permission licensing and access control. These vulnerabilities stem from improper execution of the ChrootDirectory configuration directive, which may allow remotely authenticated attackers to bypass security restrictions...

Nexcess BookIt authorization issue vulnerability

Nexcess BookIt versions 2.6.0.5 and earlier have an authorization issue vulnerability. This vulnerability stems from improper access control configurations, which may lead to missing authorizations...

Openwave Webtop Media Transcoder: Permissions, licensing, and access control issues

Openwave Webtop Media Transcoder versions prior to 1.1.22.0 have vulnerabilities related to permission licensing and access control. These vulnerabilities stem from the lack of enforcement of file type restrictions defined by administrators, which may allow authenticated users to bypass the...

Arcane Permission Licensing and Access Control Vulnerabilities

Versions of Arcane 2.6.0 and earlier have vulnerabilities related to permission licensing and access control. These vulnerabilities arise from the UpdateUser function in backend/api/handlers/users.go, which sets a PasswordHash without comparing the caller’s permissions with the target permissions...

Frappe permissions and access control issues

Versions of Frappe prior to 15.120.0 and versions before 16.33.0 16.x series have vulnerabilities related to permission licensing and access control. These vulnerabilities stem from the lack of enforcement of per-user restrictip allowlists for non-session authentication methods, such as API keys,...

LizardByte Sunshine Authorization Issue Vulnerability

LizardByte Sunshine version 2026.329.165800 to 2026.906.222525 contains an authorization issue vulnerability. This vulnerability arises from accepting any client certificate linked to a stored pairing client certificate, without requiring the certificate to represent an explicitly enabled pairing...

WordPress MailOptin: Permissions, permissions grants, and access control issues

WordPress MailOptin 1.2.78.6 and earlier versions have vulnerabilities related to permission granting and access control. This vulnerability arises from the subscribetoemaillist endpoint accepting the optindataformcustomfieldmappings parameter provided by attackers, without any validation of the...

Nexcess Advanced Post Manager Authorization Issue Vulnerability

Nexcess Advanced Post Manager versions 4.5.6 and earlier have an authorization issue vulnerability. This vulnerability stems from the lack of authorization and improper configuration of access control levels, which may allow attackers to exploit incorrectly configured access controls...

jfarthing84 Theme My Login Permission and Access Control Vulnerabilities

jfarthing84 Theme: Versions 7.2.1 and earlier have vulnerabilities related to permission authorization and access control. These vulnerabilities arise from plugins failing to correctly verify user identities before updating user passwords. This allows unauthorized attackers to change any user’s...

FastapiAdmin authorization issue vulnerability

In FastAPIAdmin versions 3.0 and earlier, there is an authorization issue vulnerability. This vulnerability stems from the lack of protection for the automatic login endpoint. Unauthorized attackers can list users through /api/v1/auth/auto-login/users, obtain the superuser automatic login token,...

Huly Platform Authorization Issue Vulnerability

Huly Platform versions 0.7.432 and earlier have an authorization issue vulnerability. This vulnerability stems from a lack of authorization verification. Any authenticated user can merge any number of persons by calling the mergeSpecifiedPersons account RPC, which may allow attackers to take...