Multiple vulnerabilities in QND

Overview QND Standard/Premium provided by QualitySoft Corporation contains multiple vulnerabilities listed below: Use of hard-coded cryptographic key CWE-321 - CVE-2026-81326 Improper access control on a named pipe CWE-782 - CVE-2026-84408 Taisei Ogura of MOTEX Inc. reported this vulnerability to...

CVE-2026-87959 WPBot 8.7.2 - 8.7.5 - Subscriber+ Claude AI Settings Update

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI...

EUVD-2026-80212

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI...

CVE-2026-87854

The Subscriptions for WooCommerce WordPress plugin, in versions before 2.0.3 , is vulnerable to an unauthenticated subscription data disclosure . The root cause is an insufficient validation of the shared secret protecting one of its REST endpoints . This flaw allows unauthorized users to retriev...

CVE-2026-87854 Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...

CVE-2026-87854 Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST endpoints, allowing unauthenticated users to retrieve the store's full list of subscriptions, including customer usernames, product names, recurring amounts and...

CVE-2026-85569 Tutor LMS 2.7.1 - < 4.0.8 - Read-Only API Key Privilege Escalation via REST Request Misclassification

The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential, allowing the holder of a read-only key to act as the administrator account that issued it...

CVE-2026-85569 Tutor LMS 2.7.1 - < 4.0.8 - Read-Only API Key Privilege Escalation via REST Request Misclassification

The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential, allowing the holder of a read-only key to act as the administrator account that issued it...

CVE-2026-85569

The Tutor LMS WordPress plugin (versions before 4.0.8 ) is vulnerable to a Read-Only API Key Privilege Escalation flaw. The root cause is the plugin's failure to correctly determine if an incoming request is addressed to its own REST API , combined with a failure to enforce permissions recorded a...

EUVD-2026-80047

NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpdconfigshowcgi.c, ipsecshowcgi.c, and modvpnremote/plan.json read handlers. Attackers can query l2tpdconfigshow.cgi to expose stored IPsec PSK and RSA key material...

EUVD-2026-80010

A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard...

EUVD-2026-80012

A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framework component of Wärtsilä FOS-Onboard...

SUSE CVE-2021-26322

Persistent platform private key may not be protected with a random IV leading to a potential "two time pad attack"...

PT-2026-93424

Name of the Vulnerable Software and Affected Versions Arista EOS affected versions not specified Description On platforms running Arista EOS with Simple Network Management Protocol SNMP configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value...

SSRF vulnerability in gradle allows capturing the Develocity access key

gradle provides global options for administrators to detect build scan links in build logs, and to show an enriched build scan summary for those build scans on the build page. In gradle 2.19.1252.v15196b5a6e10 and earlier, the enriched build scan summary requests data from the build scan link...

CVE-2026-42784: Improper Verification of Cryptographic Signature

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an...

CVE-2026-92132: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Jenkins Gradle Plugin 2.19.1252.v15196b5a6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key...

PT-2026-94077

Name of the Vulnerable Software and Affected Versions LibreTranslate versions prior to 1.9.7 Description The download file route omits the access check decorator, which enables unauthenticated access to translated files. This allows attackers to bypass API key requirements and ignore ban lists to...

CVE-2026-92716: Authorization Bypass Through User-Controlled Key

Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability in the HandleApiGeneration endpoint that allows administrators to reset and read API keys of non-administrator users in other organizations. Attackers with admin privileges in one organization can supply arbitrary us...

CVE-2026-81326: Use of Hard-coded Cryptographic Key

QND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to obtain administrator credentials, including an ID and password...