CVE-2026-74001

Unauthenticated Broken Authentication in User Registration & Membership Pro = 5.4.5 versions...

CVE-2026-66682

Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce = 10.4.0 versions...

CVE-2026-66647

Subscriber Broken Access Control in Homlisti = 3.1.2 versions...

CVE-2026-66677

Subscriber Broken Authentication in Leyka = 3.32.3 versions...

CVE-2026-66595

Unauthenticated Broken Access Control in WP Data Access = 5.5.80 versions...

CVE-2025-62307

HCL IntelliOps Event Management IEM is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege probing...

CVE-2025-53999

Unauthenticated Broken Access Control in Altair = 5.2.2 versions...

CVE-2025-15689

Unauthenticated Privilege Escalation in Capella = 2.5.5 versions...

EUVD-2025-210753

HCL IntelliOps Event Management IEM is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privilege that could not be accessed with the attacker's original privileges...

CVE-2025-62299

HCL IntelliOps Event Management (IEM) has a least-privilege violation allowing a privileged (PR:H) network attacker to access resources beyond their original privileges, with HIGH confidentiality impact. CVSS 6.6 MEDIUM; no exploitation details or fix version provided in the documents.

EUVD-2025-210750

HCL IntelliOps Event Management IEM is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege probing...

EUVD-2026-63320

Unauthenticated Broken Access Control in Koji = 2.2.1 versions...

EUVD-2026-63319

Unauthenticated Broken Access Control in EPROLO Dropshipping = 2.4.2 versions...

CVE-2026-74018

CVE-2026-74018 is an Arbitrary File Upload vulnerability in the WordPress Theme Warehouse Cargo (versions ≤ 2.6.9 ). The vulnerability is accessible to users with Subscriber privileges and carries a CVSS 3.1 score of 9.9 (Critical) , with a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicatin...

CVE-2026-74016

The WordPress Smart Cleaning theme (≤4.8.6) allows any logged-in subscriber to upload arbitrary files, enabling remote code execution. Patchstack reports this as critical (CVSS 9.9) with a fix available in newer theme versions; upgrading the theme is the primary mitigation. No in-the-wild exploit...

CVE-2026-74013

eShipper Commerce WordPress plugin (versions

CVE-2026-74001

User Registration & Membership Pro is a WordPress plugin affected by an unauthenticated broken authentication vulnerability in versions ≤ 5.4.5 , enabling account takeover without any prior credentials. The flaw was discovered by 0xd4rk5id3 and carries a CVSS 3.1 score of 9.8 (CRITICAL) with a ne...

CVE-2026-73998

The WordPress WP w3all phpBB plugin (≤ 3.0.5) has a SQL injection vulnerability exploitable by authenticated subscribers with network access; no patch version or in-the-wild exploitation details are provided in the documents.

EUVD-2026-63311

Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...

CVE-2026-73992

The WordPress Query Wrangler plugin (versions ≤ 1.5.57) allows authenticated subscribers to execute arbitrary code remotely, yielding full server compromise (CVSS 9.9 Critical, network-exploitable with low complexity). No in-the-wild exploitation or patch version is documented in the provided sou...