CVE-2026-17538

The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the processstepcustomer function using isuserloggedin as the sole gate before merging POSTed customer data into an...

PT-2026-107832

The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's creation time to predict the hash and then...

CVE-2024-24409

CVE-2024-24409 - Vulnerabilidad de Elevación de Privilegios en ADManager Plus Build 7210 Descripción Modificar Equipos es un rol predefinido en ADManager para gestionar equipos. Si un usuario técnico tiene el privilegio Modificar Equipos sobre un equipo, puede cambiar los atributos...

Improper Access Control

Payload is vulnerable to improper access control. The vulnerability is due to insufficient enforcement of the access.update restriction, which allows an attacker with appropriate access to bypass the restriction and modify a user's password...

CVE-2026-14911

Improper Neutralization of Input During Web Page Generation “Cross-site Scripting” in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.Refer to the ' Security Updat...

CVE-2026-19396

A predictable seed in the pseudo-random number generator PRNG in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user to derive the pairing token and read or modify router settings via observed values from an administrator-initiated IFTTT pairing...

CVE-2026-14911

A Cross-site Scripting (XSS) vulnerability exists in ASUS router modules due to the improper neutralization of input during web page generation. A remote attacker can exploit this flaw by tricking an authenticated user into visiting a crafted URL. Successful exploitation may allow the attacker to...

EUVD-2026-94159

Improper Neutralization of Input During Web Page Generation “Cross-site Scripting” in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.Refer to the ' Security Updat...

CVE-2026-14911

Improper Neutralization of Input During Web Page Generation “Cross-site Scripting” in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.Refer to the ' Security Updat...

CVE-2026-19396

The ASUS RT-BE57 router is vulnerable to an issue where a predictable seed in the pseudo-random number generator (PRNG) is used during IFTTT pairing token generation . This flaw allows an unauthenticated nearby user to derive the pairing token by observing values during an administrator-initiated...

CVE-2026-19396

A predictable seed in the pseudo-random number generator PRNG in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user to derive the pairing token and read or modify router settings via observed values from an administrator-initiated IFTTT pairing...

EUVD-2026-94158

A predictable seed in the pseudo-random number generator PRNG in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user to derive the pairing token and read or modify router settings via observed values from an administrator-initiated IFTTT pairing...

CVE-2026-19396

A predictable seed in the pseudo-random number generator PRNG in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user to derive the pairing token and read or modify router settings via observed values from an administrator-initiated IFTTT pairing...

PT-2026-107383

A predictable seed in the pseudo-random number generator PRNG in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user to derive the pairing token and read or modify router settings via observed values from an administrator-initiated IFTTT pairing...

PT-2026-107385

Improper Neutralization of Input During Web Page Generation “Cross-site Scripting” in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.Refer to the ' Security Updat...

CVE-2026-102407

A flaw was found in Elasticsearch. An authenticated user with permissions for at least one resource can exploit improper access controls in the Modify Data Streams application programming interface API to alter unauthorized data streams. Successful exploitation allows the user to inject data or...

CVE-2026-79805

An authenticated path traversal vulnerability exists in ClearPass Policy Manager. Successful exploitation could allow an attacker to read and modify certain files on the underlying operating system...

AZL-106715 CVE-2026-102407 affecting package rubygem-elasticsearch 8.9.0-1

Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data...

CVE-2026-102407

Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data...

CVE-2026-101156

A stored cross-site scripting XSS vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affected configuration. Successful...