Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials

Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code VS Code extension named Solidity Pro "solidity-pro" that has been observed delivering a browser wallet and credential stealer. The names of the extensions are below - helper-beeps.solidity-pro web3devtoolsx.solidity-p...

CVE-2026-19074

The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 = 3.4.2 is vulnerable to unauthenticated sensitive information exposure via the AJAX action acadppubliccustomfieldslistings...

CVE-2026-19074

The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 = 3.4.2 is vulnerable to unauthenticated sensitive information exposure via the AJAX action acadppubliccustomfieldslistings...

EUVD-2026-54998

The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 = 3.4.2 is vulnerable to unauthenticated sensitive information exposure via the AJAX action acadppubliccustomfieldslistings...

CVE-2026-19074 Advanced Classifieds & Directory Pro < 3.4.3 - Unauthenticated Non-Public Listing Custom Field Disclosure

The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 = 3.4.2 is vulnerable to unauthenticated sensitive information exposure via the AJAX action acadppubliccustomfieldslistings...

CVE-2026-19074

The Advanced Classifieds & Directory Pro WordPress plugin (versions prior to 3.4.3 ) is vulnerable to unauthenticated sensitive information exposure. This issue occurs via the AJAX action acadp_public_custom_fields_listings, which allows unauthorized actors to disclose non-public listing custom f...

CVE-2026-14211

The Booking for Appointments and Events Calendar (Amelia Pro) WordPress plugin before version 9.7 is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is a failure to verify that an authenticated employee (provider) is authorized to access a specific customer's record. An ...

CVE-2026-14211 Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR

The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee provider is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any...

CVE-2026-14211 Amelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDOR

The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee provider is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any...

PT-2026-69420

Name of the Vulnerable Software and Affected Versions ECOVACS PRO App affected versions not specified Description Android and iOS applications of the ECOVACS PRO App fail to properly validate server certificates. This flaw allows communication to be intercepted and potentially modified...

PT-2026-69414

Name of the Vulnerable Software and Affected Versions DEEBOT PRO M1 affected versions not specified DEEBOT PRO K1VAC affected versions not specified Description DEEBOT PRO M1 and DEEBOT PRO K1VAC fail to validate server certificates during MQTT communications. This lack of validation allows for t...

CVE-2026-66407: Use of a Broken or Risky Cryptographic Algorithm

DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle attack, and communication contents may be altered...

PT-2026-69413

Name of the Vulnerable Software and Affected Versions DEEBOT PRO M1 affected versions not specified DEEBOT PRO K1VAC affected versions not specified Description These devices leave a web server enabled that was intended for debugging purposes. This configuration allows for the unauthorized...

PT-2026-69416

Name of the Vulnerable Software and Affected Versions DEEBOT PRO M1 affected versions not specified DEEBOT PRO K1VAC affected versions not specified Description These products use the wget command with server certificate validation disabled. This flaw allows a man-in-the-middle attack, where an...

CVE-2026-66403: Active Debug Code

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved...

CVE-2026-66404: Improper Certificate Validation

DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products may be retrieved...

PT-2026-69419

Name of the Vulnerable Software and Affected Versions DEEBOT PRO M1 affected versions not specified DEEBOT PRO K1VAC affected versions not specified Description These devices are configured with weak passwords for their Wi-Fi hotspot networks, which may allow an attacker to analyze and obtain the...

CVE-2026-66409: Use of Weak Credentials

DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to the access point of an affected robot...

PT-2026-69418

Name of the Vulnerable Software and Affected Versions DEEBOT PRO M1 affected versions not specified DEEBOT PRO K1VAC affected versions not specified Description The root accounts are configured with weak passwords. Physical access to an affected product may allow an attacker to obtain the root...

PT-2026-69415

Name of the Vulnerable Software and Affected Versions DEEBOT PRO M1 affected versions not specified DEEBOT PRO K1VAC affected versions not specified Description These devices leave telnet servers enabled, which may allow unauthorized users to log in to the affected products via the telnet service...