CVE-2026-92403 Secure Custom Fields < 6.9.4 - Unauthenticated Post Modification via Front-End Form ID Substitution

The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor, allowing unauthenticated users to submit against a different registered form and modify the title and content of the post that...

CVE-2026-92403

The Secure Custom Fields WordPress plugin, in versions prior to 6.9.4 , is susceptible to an unauthenticated post modification vulnerability. The root cause is a failure to properly verify that a front-end form submission corresponds to the specific form rendered to the visitor. This allows unaut...

PT-2026-95764

Name of the Vulnerable Software and Affected Versions Secure Custom Fields WordPress plugin versions prior to 6.9.4 Description An issue exists where the plugin fails to properly verify that a front-end form submission matches the form rendered to the visitor. This allows unauthenticated users to...

CVE-2026-92403: Incorrect Authorization

The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor, allowing unauthenticated users to submit against a different registered form and modify the title and content of the post that...

CVE-2026-77875 Hide Photos - Secure vault 4.1.0 - Insecure storage of vault media and wallet records in shared external storage

The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, such as through an authorized non-root ADB shell or another local file-reading context with suitable...

WordPress Secure Copy Content Protection and Content Locking plugin < 5.1.5 - Admin+ Stored XSS via ays_sccp_sub_icon_image Parameter vulnerability

Admin+ Stored XSS via ayssccpsubiconimage Parameter vulnerability discovered by Luca Jungnickel in WordPress Plugin Secure Copy Content Protection and Content Locking versions 5.1.5...

Cisco UCS Manager UEFI Shell Secure Boot Bypass (cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW)

According to its self-reported version, Cisco UCS Manager Software is affected by a vulnerability. - A vulnerability in the Unified Extensible Firmware Interface UEFI Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials fo...

Cisco Secure Firewall Threat Defense Software sftunnel Authentication Bypass (cisco-sa-fmcftd-sftun-multivulns-WGVHOrN3)

According to its self-reported version, Cisco Secure Firewall Threat Defense FTD Software is affected by multiple vulnerabilities. - A denial of service DoS vulnerability exists in the sftunnel functionality due to improper memory management. An unauthenticated, remote attacker can exploit this...

Cisco Secure Firewall Management Center Software sftunnel Authentication Bypass (cisco-sa-fmcftd-sftun-multivulns-WGVHOrN3)

According to its self-reported version, Cisco Secure Firewall Management Center FMC is affected by multiple vulnerabilities. - A denial of service DoS vulnerability exists in the sftunnel functionality due to improper memory management. An unauthenticated, remote attacker can exploit this issue,...

Cisco Integrated Management Controller UEFI Shell Secure Boot Bypass (cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW)

According to its self-reported version, the Cisco Integrated Management Controller is affected by a vulnerability. - A vulnerability in the Unified Extensible Firmware Interface UEFI Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with vali...

Cisco Secure Firewall Threat Defense Software TLS 1.3 DoS (cisco-sa-ftd-tls1-3-dos-dLxwFWgF)

According to its self-reported version, Cisco Secure Firewall Threat Defense FTD Software is affected by a denial of service vulnerability. A flaw exists within the TLS 1.3 implementation due to improper buffer management. An unauthenticated, remote attacker can exploit this issue, via a crafted...

Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)

Summary Steeltoe's Consul discovery client parses the secure metadata field on each registered service instance using bool.Parse, which throws on any value other than true or false. A single service instance registered with a malformed secure value for example yes or 1 aborts construction of the...

Improper Handling of Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions due to the ConsulServiceInstance parsing of Consul service metadata in src/Discovery/src/Consul/ConsulServiceInstance.cs. An attacker can abort service instance lookup by registering a service...

GHSA-67C9-F6V2-QV86 Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)

Summary Steeltoe's Consul discovery client parses the secure metadata field on each registered service instance using bool.Parse, which throws on any value other than true or false. A single service instance registered with a malformed secure value for example yes or 1 aborts construction of the...

CVE-2026-92758 Logs may collect sensitive information

If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information if in use such as passwords and AWS secure access keys...

CVE-2026-81516

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 until 4.3.0, ConsulDiscoveryClient constructs ConsulServiceInstance objects by parsing each registration's secure metadata with a strict Boolean conversion. A...

CVE-2026-81516

Steeltoe.Discovery.Consul (versions 4.0.0 through 4.3.0) is vulnerable to a denial of service caused by strict Boolean parsing of the secure metadata field in Consul service registrations. An attacker who can register a Consul service can supply a non-boolean value for secure, triggering an excep...

CVE-2026-81516 Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 until 4.3.0, ConsulDiscoveryClient constructs ConsulServiceInstance objects by parsing each registration's secure metadata with a strict Boolean conversion. A...

CVE-2026-81516 Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 until 4.3.0, ConsulDiscoveryClient constructs ConsulServiceInstance objects by parsing each registration's secure metadata with a strict Boolean conversion. A...

CVE-2026-81516 Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 until 4.3.0, ConsulDiscoveryClient constructs ConsulServiceInstance objects by parsing each registration's secure metadata with a strict Boolean conversion. A...