CVE-2026-91008

The Event Booking Manager for WooCommerce WordPress plugin, in versions prior to 5.3.8 , is vulnerable to an unauthenticated attendee PII disclosure . The flaw exists because the plugin fails to perform adequate ownership or authorization checks before rendering booking confirmation details. An a...

EUVD-2026-81351

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information full name, email address, phone...

CVE-2026-91008 Event Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure via Booking Confirmation Panel

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information full name, email address, phone...

CVE-2026-91008 Event Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure via Booking Confirmation Panel

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information full name, email address, phone...

PT-2026-94182

Name of the Vulnerable Software and Affected Versions Event Booking Manager for WooCommerce versions prior to 5.6.0 Description Insufficient access restrictions in the payment gateway configuration allow users with Contributor-level permissions or higher to view sensitive credentials. This includ...

CVE-2026-91019: Improper Access Control

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...

PT-2026-94568

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ALSA sequencer where the bounce error event function leaks a kernel memory address to userspace. When a queued variable-length event fails, the data.ext.ptr variab...

PT-2026-94449

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bnxt en driver where the hwmon notify event function is called using the platform device as the first parameter instead of the required hardware monitoring device...

PT-2026-94709

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the ath11k service ready ext event function during TLV Type-Length-Value parsing. The svc rdy ext.mac phy caps variable is allocated as a temporary resource that ...

PT-2026-94518

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ksmbd component where the ipc validate msg function computes the expected message size by reading length fields from a response buffer supplied by the userspace...

PT-2026-94377

Name of the Vulnerable Software and Affected Versions BlueKitchen BTstack versions prior to 1.8.3 Description An issue exists in A2DP stream endpoint discovery where the software fails to validate the peer-reported endpoint count against table bounds. A bonded peer can send an AVDTP DISCOVER...

CVE-2026-63460: Inefficient Regular Expression Complexity

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtracking pattern through StringOperators.regex. packages/core/src/service/helpers/list-query-builder/parse-filter-params.ts passes th...

CVE-2026-91008: Authorization Bypass Through User-Controlled Key

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information full name, email address, phone...

PT-2026-94175

Name of the Vulnerable Software and Affected Versions Event Booking Manager for WooCommerce versions prior to 5.3.8 Description The plugin fails to perform ownership or authorization checks before rendering booking confirmation details. This allows unauthenticated attackers to retrieve personal...

PT-2026-94456

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the SMC LLC Shared Memory Communications Local LLC implementation. When the smc llc event handler function transitions a local LLC flow from SMC LLC FLOW REQ ADD...

PT-2026-94977

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel regarding the ordering of reference and unreference operations within the perf/x86/intel/uncore component. In the uncore event cpu online function,...

PT-2026-94539

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the riscv-sbi-mpxy mailbox component where the SBI return value, which determines the number of bytes copied from shared memory into the RPMI notification buffer, is n...

CVE-2026-92498: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: avoid buffer overreads in WMI event handlers The following WMI event handlers currently read from the event buffer without first verifying that the message was large enough to hold the expected event:...

CVE-2026-92942: Uncontrolled Resource Consumption

vm2 before 3.11.7 affected versions = 3.11.6 does not enforce the VM timeout option on code executed outside the synchronous VMrun call. The timeout only wraps the single call to runScript via doWithTimeout in lib/vm.js, and FinalizationRegistry and WeakRef are exposed to sandboxed code unmodifie...

PT-2026-94580

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.0-rc5 Description An issue exists in the AMT Advanced Memory Transport module where cross-network namespace netns setup is unintentionally supported. When a lower device is unregistered, the amt device event...