CVE-2026-94104: Unrestricted Upload of File with Dangerous Type

NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible...

PT-2026-96004

Name of the Vulnerable Software and Affected Versions samanhappy MCPHub versions prior to 1.0.33 Description Improper privilege management exists within the Template Import Endpoint. The issue resides in the importTemplate function located in the src/services/templateService.ts file, allowing for...

rustinel v1.8.0-rc.1

Rustinel Open-source endpoint detection. Three platforms. Your rules. Run Sigma, YARA, and IOC detections on native Windows, Linux, and macOS telemetry. Written in Rust, with local alerts and no cloud account required. Download | Documentation | Detection packs | Website Why Rustinel? Use Sigma a...

CVE-2026-93954 grimmory-tools grimmory Settings API Endpoint AppSettingController.java AppSettingController.getAppSettings authorization

A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the file backend/src/main/java/org/booklore/controller/AppSettingController.java of the component Settings API Endpoint. Such manipulation leads...

CVE-2026-93954 grimmory-tools grimmory Settings API Endpoint AppSettingController.java AppSettingController.getAppSettings authorization

A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the file backend/src/main/java/org/booklore/controller/AppSettingController.java of the component Settings API Endpoint. Such manipulation leads...

CVE-2026-93954

grimmory-tools grimmory (up to 3.3.3/3.4.1) contains an incorrect authorization flaw in the Settings API Endpoint . The vulnerable function is AppSettingController.getAppSettings in backend/src/main/java/org/booklore/controller/AppSettingController.java. The issue arises because PR #2558 moved th...

HardBreacher

HardBreacher Kaspersky Antivirus For Endpoint のゼロデイ権限昇格の脆弱性 この問題は今やMicrosoftの外にも漏れ出しています。ホーム版か商用版のどちらかにバグを見つけるかという投票が行われ、投票結果は商用版となりました。 これを書いている時点で、この概念実証は完全にパッチが適用されたWindows 11 25H2とKaspersky for Endpoint v14.0.0.504で動作します。...

CVE-2026-9832

The Payment Gateway of Stripe for WooCommerce WordPress plugin (all versions up to and including 5.0.8 ) is vulnerable to improper verification of cryptographic signature . The publicly accessible woocommerce_api_wt_stripe webhook endpoint wraps its sole call to \Stripe\Webhook::constructEvent() ...

CVE-2026-92404

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site...

EUVD-2026-83512

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site...

CVE-2026-92404

The MgoSync WordPress plugin versions 2.1.5 through 2.1.6 is vulnerable to an unauthenticated WooCommerce API Credential Disclosure vulnerability. Due to a lack of authorization controls on a specific REST API endpoint , an unauthenticated user can retrieve stored WooCommerce API credentials, inc...

CVE-2026-92404 MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site...

CVE-2026-89334 Better Messages <= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/<id>' REST Endpoint

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.15.33. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CLEANSTART-2026-YL24808 flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management

Security vulnerability affects the keycloak package. A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management...

CLEANSTART-2026-RG79000 Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period

Security vulnerability affects the vault package. Vault and Vault Enterprise’s “Vault” TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period...

PT-2026-95775

Name of the Vulnerable Software and Affected Versions Create plugin for WordPress versions prior to 2.5.4 Description An issue exists where authenticated attackers with author-level access or higher can perform a SQL Injection. This occurs because the order by parameter is not sufficiently escape...

PT-2026-95870

Name of the Vulnerable Software and Affected Versions grimmory-tools grimmory versions 3.3.3 and earlier grimmory-tools grimmory versions 3.4.1 and earlier Description An authorization bypass exists in the Download Endpoint component. A remote attacker can manipulate the bookId argument within th...

CVE-2026-93955: Authorization Bypass Through User-Controlled Key

A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/main/java/org/booklore/controller/KoboController.java of the component Download Endpoint. Performing a manipulation of the argumen...

CVE-2026-93954: Incorrect Authorization

A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the file backend/src/main/java/org/booklore/controller/AppSettingController.java of the component Settings API Endpoint. Such manipulation leads...

PT-2026-95869

Name of the Vulnerable Software and Affected Versions grimmory-tools grimmory versions 3.3.3 and earlier grimmory-tools grimmory versions 3.4.1 and earlier Description An incorrect authorization issue exists in the Settings API Endpoint. A remote attacker can manipulate the...