PT-2026-137217

Name of the Vulnerable Software and Affected Versions VitaFit cloud API versions prior to 2026-10-30 Description An excessive data exposure issue allows authenticated users to retrieve personally identifiable information PII and health-related profile data. By querying the 'GET...

CVE-2022-44268-MagiLeak

ImageMagick Arbitrary Read Files - CVE-2022-44268 This repository contains a proof-of-concept PoC code for exploiting the arbitrary file read vulnerability CVE-2022-44268 in ImageMagick. The PoC demonstrates how an attacker can leverage the vulnerability to read arbitrary files on the system...

Twitter-Info

Twitter Info A simple python script to grab Twitter account info like: Name Following Followers Likes Account date Profile picture just by username or profile link. Usage python3 twitterinfo.py or Example Input python twitterinfo.py ngll Output Name: Nigella Tweets: 30 Following: 8 Followers: 4...

CVE-2026-62991

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/user/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks readcustomers but looks up an arbitrary user ID without applying the customers role scope used by the listing...

CVE-2026-62991 Shopper: customer detail IDOR exposes administrator and staff records

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/user/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks readcustomers but looks up an arbitrary user ID without applying the customers role scope used by the listing...

EUVD-2026-114512

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/user/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks readcustomers but looks up an arbitrary user ID without applying the customers role scope used by the listing...

CVE-2026-62991 Shopper: customer detail IDOR exposes administrator and staff records

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/user/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks readcustomers but looks up an arbitrary user ID without applying the customers role scope used by the listing...

CVE-2026-62991 Shopper: customer detail IDOR exposes administrator and staff records

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/user/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks readcustomers but looks up an arbitrary user ID without applying the customers role scope used by the listing...

CVE-2026-62991

The Shopper Headless e-commerce Admin Panel is vulnerable to an IDOR (Insecure Direct Object Reference) flaw in versions prior to 2.10.1 . The customer detail route (/cpanel/customers/{user}/show) in packages/admin/src/Livewire/Pages/Customers/Show.php fails to apply the required customers role s...

PT-2026-134221

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/user/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks read customers but looks up an arbitrary user ID without applying the customers role scope used by the listing...

CVE-2026-62991: shopperlabs shopper: Shopper is a Headless e-commerce Admin Panel

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/user/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks readcustomers but looks up an arbitrary user ID without applying the customers role scope used by the listing...

CVE-2026-107762

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

EUVD-2026-103213

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

PT-2026-116197

Name of the Vulnerable Software and Affected Versions Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.3.3 Description An Insecure Direct Object Reference exists due to missing validation on a user-controlled key. Unauthenticated attackers can expose sensitive profi...

CVE-2026-107762: Authorization Bypass Through User-Controlled Key

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Protection was added to the device queue against concurrent access. In the dasdprofilestart function, the number of requests on the device queue is counted. However, access to the device queue is not protected against...

CVE-2026-21123

Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock...

Amazon has an uncomfortably personal profile on you

Amazon’s “About You” page reveals what it thinks it knows about you—and you can’t simply switch it off. Dexerto reports that one shopper discovered her profile included the observation: “has flat buttocks” She suggested this might relate to a previous purchase of “butt scrunch leggings.” Whatever...

CVE-2026-105196

The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authenticated user holding the LatePoint Agent role, normally restricted to their own records, to read and modify other agents' profile da...

EUVD-2026-94768

The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authenticated user holding the LatePoint Agent role, normally restricted to their own records, to read and modify other agents' profile da...