CVE-2026-85083 CareCam Pro IP Cameras Use of Hard-coded Credentials

The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical access to the device may leverage this weakness to gain privileged bootloader access, allowing unauthorized modification of firmware and system configuration and potentially...

CVE-2026-85083

CVE-2026-85083 affects the ANJIA AJL33PC0801 IP camera (CareCam Pro), which ships with a hard-coded credential used for bootloader authentication . The affected firmware is linuxlinux202008261138 svn13796 with U-Boot 2010.06 (compiled Aug 26, 2020). An attacker with physical access can exploit th...

WordPress WPCafe plugin 3.0.10-3.0.17 - Unauthenticated Order Disclosure and Modification vulnerability

Unauthenticated Order Disclosure and Modification vulnerability discovered by Artus KG in WordPress Plugin WPCafe versions 3.0.10-3.0.17...

CVE-2026-86782

The Visualizer WordPress plugin (versions 4.0.0-4.0.5 ) is vulnerable to an authorization bypass due to improper access controls on its chart-building actions. This flaw allows users with a Contributor role or higher to perform unauthorized actions, such as publishing, renaming, and overwriting t...

CVE-2026-86782 Visualizer < 4.0.6 - Contributor+ Arbitrary Post/Page Modification via IDOR

The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts...

CVE-2026-86782 Visualizer < 4.0.6 - Contributor+ Arbitrary Post/Page Modification via IDOR

The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts...

CVE-2026-86812

The WPCafe WordPress plugin versions 3.0.10 through 3.0.17 is vulnerable to improper access control. The root cause is that permission callbacks for certain order-management REST endpoints return an incorrect type upon failure, failing to properly restrict access. This allows unauthenticated user...

WordPress Visualizer plugin 4.0.0-4.0.5 - Contributor+ Arbitrary Post/Page Modification vulnerability

Contributor+ Arbitrary Post/Page Modification vulnerability discovered by Artus KG in WordPress Plugin Visualizer versions 4.0.0-4.0.5...

CVE-2026-86812 WPCafe 3.0.10 - 3.0.17 - Unauthenticated Order Disclosure and Modification via food-orders REST API

The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failure, allowing unauthenticated users to disclose guest order information and to change the status of, or trash...

CVE-2026-11446

The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the createorderpermission permission callback on the POST /wp-json/booktics/v1/orders REST...

EUVD-2026-75936

The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the createorderpermission permission callback on the POST /wp-json/booktics/v1/orders REST...

CVE-2026-11446

The Booktics – Booking Calendar for Appointments and Service Businesses WordPress plugin (≤ 1.0.23) is vulnerable to unauthorized data modification due to a missing authorization check. The create_order_permission() callback on the POST /wp-json/booktics/v1/orders REST route unconditionally retur...

CVE-2026-11446 Booktics – Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing Authorization

The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the createorderpermission permission callback on the POST /wp-json/booktics/v1/orders REST...

CVE-2026-49992: Cross-Site Request Forgery (CSRF)

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through GET routes and directly create or reuse a Team,...

PT-2026-89855

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated users to modify other users' links. A canStream user can overwrite another user's LiveLink HLS source and metadata by supplying an existing...

PT-2026-89779

The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site...

PT-2026-89745

The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the create order permission permission callback on the POST /wp-json/booktics/v1/orders REST...

PT-2026-90059

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the sysctl implementation where the cad pid entry is incorrectly placed in the pid table instead of the kern reboot table. Because of the pid table root permissions...

CVE-2026-90454: Missing Authorization

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request...

CVE-2026-11446: Missing Authorization

The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the createorderpermission permission callback on the POST /wp-json/booktics/v1/orders REST...