Winter: My Account preview exposes another backend user's profile by record ID

Impact Backend\Controllers\MyAccount, introduced in v1.2.13, declares an empty $requiredPermissions array so that any authenticated backend user can manage their own account. It implements the FormController behavior, which exposes three routable actions — create, update and preview — that each...

CVE-2026-55642

In dbx-web before 0.5.51, auth_middleware in crates/dbx-web/src/auth.rs bypasses authentication when password_hash is None, which occurs on fresh deployments with DBX_PASSWORD unset. The service binds to 0.0.0.0:4224 by default, allowing unauthenticated attackers to call /api/connection/connect a...

EUVD-2026-63470

dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web authmiddleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when passwordhash is None. A fresh deployment reaches that state when DBXPASSWORD is unset and no stored password exists...

EUVD-2026-63259

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vulnerability in the MongoDB node's Find, Delete, and Aggregate operations, which parse the Query parameter as JSON after expression resolution without sanitizing MongoDB operators. An attacker who can influence the resolved query...

CVE-2026-77070 n8n before 1.123.69 NoSQL Injection via MongoDB Node

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vulnerability in the MongoDB node's Find, Delete, and Aggregate operations, which parse the Query parameter as JSON after expression resolution without sanitizing MongoDB operators. An attacker who can influence the resolved query...

WordPress Tourmaster plugin < 5.4.9 - Unauthenticated Sensitive Data Disclosure via Order Export vulnerability

Unauthenticated Sensitive Data Disclosure via Order Export vulnerability discovered by WPscan in WordPress Plugin TourMaster Plugin versions 5.4.9...

WordPress Amelia plugin 7.0-9.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Mustafa Ahmed in WordPress Plugin Amelia versions 7.0-9.6...

WordPress WP Data Access plugin < 5.5.79 - Unauthenticated Sensitive Data Disclosure via Autocomplete Column Authorization Bypass vulnerability

Unauthenticated Sensitive Data Disclosure via Autocomplete Column Authorization Bypass vulnerability discovered by Farid Narimanov in WordPress Plugin WP Data Access versions 5.5.79...

CVE-2026-19699

The GutenKit WordPress plugin (versions 2.4.12–2.4.15 , before 2.5.0) contains an insufficient capability check on certain REST API endpoints . This allows authenticated users with the Contributor role or higher to retrieve mailing-list audience metadata from the site's connected Mailchimp market...

CVE-2026-19699 GutenKit 2.4.12 - 2.4.15 - Contributor+ Mailchimp Audience Data Disclosure

The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account...

PT-2026-79140

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, a crafted many-band TIFF processed through VipsForeignLoadTiff can evade scanline validation in libvips/iofuncs/image.c and cause an integer overflow in vips image sanity. The resulting buffer-region...

PT-2026-78926

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions prior to 2.33.4 n8n versions prior to 2.34.1 Description A NoSQL injection issue exists in the MongoDB node's Find, Delete, and Aggregate operations. The software parses the Query parameter as JSON...

PT-2026-79143

Name of the Vulnerable Software and Affected Versions libvips versions prior to 8.18.3 Description The old-style Radiance RLE Run-Length Encoding decoder in libvips/foreign/radiance.c contains a flaw where it can process a repeat marker at the start of a scanline in the scanline read old function...

CVE-2026-55564 FreeRDP: Out-of-bounds read in glyph_cache_get via crafted glyph fragments

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyphcacheget function in libfreerdp/cache/glyph.c checks whether index is greater than cache-number instead of greater than or equal to it. A malicious RDP server can use GLYPHFRAGMENTUSE replay in...

CVE-2026-55564 FreeRDP: Out-of-bounds read in glyph_cache_get via crafted glyph fragments

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyphcacheget function in libfreerdp/cache/glyph.c checks whether index is greater than cache-number instead of greater than or equal to it. A malicious RDP server can use GLYPHFRAGMENTUSE replay in...

CVE-2026-76238

stigmem before 0.9.0a12 has a BOLA flaw in the decay sweep endpoint. Authenticated attackers with write access to one tenant can POST with ttl_seconds=0 to expire facts across all tenants, or use dry_run to retrieve cross-tenant fact counts and existence data. CVSS 4.0 scores 7.2 HIGH (integrity ...

CVE-2026-76205 phpMyFAQ before 4.1.7 SQL Injection via Glossary

phpMyFAQ before 4.1.7 contains a SQL injection vulnerability in the glossary create and update endpoints caused by truncating an escaped string before embedding it in a SQL literal. Authenticated users with glossary add or edit permissions can craft a payload with a dangling backslash to escape t...

MINI-MWJR-G3R3-5X4G

Bulletin has no description...

BIT-KIBANA-2026-72670 Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials

A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key...

CVE-2026-19709

The Membership For WooCommerce WordPress plugin before 3.1.2 contains an unauthenticated data disclosure vulnerability in its REST API authentication logic. The plugin fails to verify that an API consumer secret has actually been generated before comparing it against the value supplied in a reque...