GFI Kerio Control 9.4.5 Unsigned Firmware Update Remote Code Execution

GFI Kerio Control version 9.4.5 accepts unsigned firmware images, allowing an authenticated attacker to execute arbitrary code as root. This proof of concept creates and uploads a modified upgrade image. https://packetstorm.news/download/235083...

PT-2026-109846

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0...

PT-2026-109702

Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2...

PT-2026-109698

Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GIFT4U: from n/a through 1.1.3...

PT-2026-109773

Unauthenticated Broken Access Control in Grand News = 3.4 versions...

PT-2026-109744

Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/...

PT-2026-109761

Subscriber Broken Access Control in Jetpack VideoPress = 3.6 versions...

PT-2026-109602

ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. The access control for methods within the framework is insufficient. An attacker can exploit this method to read device-related information...

CVE-2026-42706: Missing Authorization

Unauthenticated Broken Access Control in DK = 3.2.1 versions...

CVE-2026-40777: Missing Authorization

Subscriber Broken Access Control in WPSection = 1.5.1 versions...

CVE-2026-42705: Missing Authorization

Unauthenticated Broken Access Control in Grand News = 3.4 versions...

CVE-2026-40808: Missing Authorization

Subscriber Broken Access Control in Jetpack VideoPress = 3.6 versions...

CVE-2026-103685: Missing Authorization

Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/...

CVE-2026-93950: Missing Authorization

Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.108...

CVE-2026-108504: Improper Privilege Management

ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. The access control for methods within the framework is insufficient. An attacker can exploit this method to read device-related information...

CVE-2026-106609: Missing Authorization

Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2...

CVE-2026-103357: Missing Authorization

Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GIFT4U: from n/a through 1.1.3...

CVE-2026-62035: Missing Authorization

Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted = 3.1.0 versions...

CVE-2026-40801: Missing Authorization

Subscriber Broken Access Control in Wordable = 8.2.10 versions...

PT-2026-109774

Name of the Vulnerable Software and Affected Versions DK versions prior to 3.2.2 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a version newer than 3.2.1...