EUVD-2026-85064

The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key...

CVE-2026-93528 NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page

The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key...

WordPress NP Quote Request for WooCommerce plugin 2.0-2.4.15 - Unauthenticated Order Data Disclosure vulnerability

Unauthenticated Order Data Disclosure vulnerability discovered by Murad Islamzada in WordPress Plugin NP Quote Request for WooCommerce versions 2.0-2.4.15...

CVE-2026-93528

The NP Quote Request for WooCommerce WordPress plugin (versions 2.0-2.4.15 ) is vulnerable to unauthenticated order data disclosure . The root cause is located in the gpls_woo_rfq_get_rfq_cart() function within includes/classes/gpls_woo_rfq_functions.php, which fails to validate order ownership w...

CVE-2026-84168 Easy Hide Login < 1.7 - Login Page Protection Bypass / Hidden URL Disclosure

The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through certain password-reset request parameters and to recover the site's configured secret login slug from the returned page...

CVE-2026-84168 Easy Hide Login < 1.7 - Login Page Protection Bypass / Hidden URL Disclosure

The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through certain password-reset request parameters and to recover the site's configured secret login slug from the returned page...

Malicious code in helpersutils-dev-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b7208dea3cf1742ac01332c17db9df968fd4a105fbccaf0b5388162b0f3673 The package presents itself as 'Development utility helpers' but its main module executes an IIFE at require-time that issues an Image request to...

MAL-2026-16465 Malicious code in helpersutils-dev-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b7208dea3cf1742ac01332c17db9df968fd4a105fbccaf0b5388162b0f3673 The package presents itself as 'Development utility helpers' but its main module executes an IIFE at require-time that issues an Image request to...

CVE-2026-95930

A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiat...

CVE-2026-95930 iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery

A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiat...

CVE-2026-95930

The iFlytek astron-agent (up to version 1.0.6 ) is vulnerable to a server-side request forgery (SSRF) . The flaw exists in the UrlCheckTool.checkUrl function within the debugToolV2 API endpoint, where a remote attacker can manipulate the endPoint argument to initiate unauthorized requests. To rem...

EUVD-2026-85001

A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiat...

CVE-2026-95930 iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery

A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiat...

CVE-2026-95930 iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery

A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiat...

EUVD-2026-84959

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information and trigger unauthorized actions due to server-side request forgery...

SUSE CVE-2026-93710

Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compilehooks. A hook that dies fires core.app.hookexception, then calls cleanup unless the failing hook is the exception handler. A handler that halts does...

CVE-2026-95602: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1...

CVE-2026-92284: Allocation of Resources Without Limits or Throttling

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and proce...

CVE-2026-90900: Cross-Site Request Forgery (CSRF)

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submission endpoint index.php?option=comeasystore&task=product.addReview accepted submissions without verifying an anti-CSRF token t...

CVE-2026-76086: Missing Authorization

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a...