CVE-2026-16575

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict access to per-vendor commission configuration returned by one of its unauthenticated store REST endpoints, allowing any unauthenticated user to disclose a vendor's commission type...

EUVD-2026-63823

The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content...

EUVD-2026-63813

The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only...

CVE-2026-76158

Datiphy Data Management Center (v8.3.0 through v8.5.1) contains a path traversal vulnerability in its upload API endpoint. An unauthenticated remote attacker can supply relative or absolute path sequences to write files to arbitrary locations outside the intended upload directory, enabling arbitr...

CVE-2026-76158 Datiphy Data Management Center - External Control of File Name or Path

External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences...

CVE-2026-77649

The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

EUVD-2026-63780

The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

CVE-2026-77650

The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

EUVD-2026-63779

The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

SUSE CVE-2026-76827

A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to...

EUVD-2026-63718

A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability WRR Enterprise Edition...

EUVD-2026-63730

The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next without checking the caller, and no customer-session middleware guards the route; the on...

EUVD-2026-63622

Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network...

PT-2026-79328

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description Improper Access Control in the Kubernetes Service CKS plugin allows cross-tenant manipulation of the Kubernetes cluster during the process of adding and removing nodes...

Kibana 8.9.x < 8.19.19 / 9.x < 9.4.5 Missing Authorization (ESA-2026-86)

The version of Kibana installed on the remote host is 8.9.x prior to 8.19.19, or 9.x prior to 9.4.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-86 advisory. - The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created th...

PT-2026-79332

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...

PT-2026-79275

The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

Linux Distros Unpatched Vulnerability : CVE-2026-54770

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response.makelocationabsolute in src/webob/response.py checks a Location value for a UR...

PT-2026-79440

In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later...

Linux Distros Unpatched Vulnerability : CVE-2026-15743

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The servestatic method always sets the Cache-Control heade...