The vulnerability of the OpenSSH cryptographic protection mechanism, which arises from performing operations in the wrong order, allows attackers to gain access to confidential data and compromise the integrity of that data.

The vulnerability of the OpenSSH cryptographic protection lies in the improper execution of certain operations. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromise the integrity of those data...

PT-2026-82882

The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site...

CVE-2026-80685: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mm/util: don't read page2 for order-1 folios in snapshotpage snapshotpage currently reads page2 after checking nrpages 1, but it should only do so when nrpages 2. If an order-1 folio is allocated at the end of a vmemmap section,...

CVE-2026-74820

CVE-2026-74820 is a CRITICAL (CVSS 4.0: 10.0) SQL injection vulnerability in the ServiceNow AI platform , specifically through a Dynamic Schema ORDER BY clause . An unauthenticated user can, under certain circumstances, execute arbitrary SQL statements against the instance's underlying database, ...

CVE-2026-74820 Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause

ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or...

CVE-2026-74820 Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause

ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or...

WordPress WPC Order Tip for WooCommerce plugin < 3.3.1 - Unauthenticated Order Data Disclosure vulnerability

Unauthenticated Order Data Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin WPC Order Tip for WooCommerce versions 3.3.1...

WordPress Dokan plugin < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint vulnerability

Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Dokan versions 5.0.11...

WordPress Dokan plugin < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint vulnerability

Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint vulnerability discovered by Shivamani Vastrala in WordPress Plugin Dokan versions 5.0.9...

CVE-2026-78125 LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...

CVE-2026-78125 LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...

WordPress LearnPress plugin < 4.0.3 - Unauthenticated Order Status Disclosure vulnerability

Unauthenticated Order Status Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin LearnPress & Sepay Payment versions 4.0.3...

CVE-2026-78125

The LearnPress WordPress plugin (specifically the Sepay Payment component) is vulnerable in versions up to and including 4.0.2 due to a missing authorization check on one of its REST endpoints . This flaw allows unauthenticated attackers to disclose the payment status of arbitrary orders by enume...

CVE-2026-59305: Incorrect Behavior Order

Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-78125: Exposure of Sensitive Information to an Unauthorized Actor

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers...

CVE-2026-46371

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple MDM commands listing endpoint GET /api/v1/fleet/mdm/apple/commands allowed an authenticated user with the lowest-privilege Observer role to extract sensitive values from joined...

CVE-2026-46370

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint GET /api/v1/fleet/labels/id/hosts allowed an authenticated user with the lowest-privilege Observer role to extract host enrollment secrets through a...

CVE-2026-46371 Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple MDM commands listing endpoint GET /api/v1/fleet/mdm/apple/commands allowed an authenticated user with the lowest-privilege Observer role to extract sensitive values from joined...

CVE-2026-46371 Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple MDM commands listing endpoint GET /api/v1/fleet/mdm/apple/commands allowed an authenticated user with the lowest-privilege Observer role to extract sensitive values from joined...

CVE-2026-46371

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple MDM commands listing endpoint GET /api/v1/fleet/mdm/apple/commands allowed an authenticated user with the lowest-privilege Observer role to extract sensitive values from joined...