Vulnerabilities in Adobe Commerce

Adobe has identified several vulnerabilities in Adobe Commerce. These vulnerabilities primarily involve incorrect authorization, which allows attackers with varying privilege levels to circumvent security checks. This enables attackers to obtain unauthorized read and write permissions, access...

CVE-2026-16737

The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored...

CVE-2026-14925

The Import WP WordPress plugin, in versions prior to 2.14.23 , is vulnerable to unauthenticated sensitive information exposure due to a lack of authorization checks on an export-file download handler. An unauthenticated attacker could potentially download export files generated by administrators,...

PT-2026-71330

Name of the Vulnerable Software and Affected Versions IBM Db2 versions 11.5.0 through 11.5.9 IBM Db2 versions 12.1.0 through 12.1.5 Description Local attackers can obtain sensitive information because plain text passwords are recorded in trace files. Recommendations At the moment, there is no...

CVE-2026-73246

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables,...

CVE-2026-66832 Mira Hormone Monitor, Mira Android App Use of GET request method with sensitive query strings

When the Mira Android app opens in-app WebView content e.g., shop redirect flows, the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web...

CVE-2026-66145

An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 Build 9510.1044 and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip...

EUVD-2026-56418

Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally...

EUVD-2026-56275

CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access...

.NET Information Disclosure Vulnerability

Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network...

CVE-2026-72554 Ladybird Web Solution Faveo Helpdesk - Broken Access Control

A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging to other customers via the v1 REST API. The API verifies the existence of the requested ticket but not ownership, enabling any authenticat...

CVE-2026-19424 Inventec Appliances｜Chiline Cloud - Insecure Direct Object Reference

Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific parameter to read other users' sensitive data...

PT-2026-70052

Name of the Vulnerable Software and Affected Versions Chiline Cloud affected versions not specified Description Chiline Cloud developed by Inventec Appliances contains an Insecure Direct Object Reference IDOR issue. This occurs when an application provides direct access to objects based on...

PT-2026-70621

Name of the Vulnerable Software and Affected Versions Microsoft Office Word affected versions not specified Description An out-of-bounds read exists in Microsoft Office Word, which allows an unauthorized attacker to disclose sensitive information locally and affect the system. An out-of-bounds re...

PT-2026-70937

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables,...

PT-2026-70447

Name of the Vulnerable Software and Affected Versions Windows Hello affected versions not specified Description Sensitive information is stored in cleartext, which allows an authorized attacker to perform local tampering to affect the system. Recommendations At the moment, there is no information...

PT-2026-70904

『We recently revisited those patches and found that none of the underlying root causes were fixed - every original CVE remained exploitable,』😩 SonicWall GMS - Unauthenticated RCE and Encrypted Password Hash Extraction CVE-2026-66145 https://t.co/hp0HOWboM9...

Devolutions Server <= 2026.1.22 / 2026.2.0 <= 2026.2.11 Multiple Vulnerabilities (DEVO-2026-0024)

The version of Devolutions Server installed on the remote host is prior or equal to 2026.1.22 or 2026.2.0 prior or equal to 2026.2.11. It is, therefore, affected by multiple vulnerabilities, including: - Improper authorization in the access request status endpoint allows an authenticated...

CVE-2025-30239 Sensitive Data Exposure due to Hardcoded Cryptographic Keys in Multiple TP-Link Aginet Devices

In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation may allow access to decrypted...

CVE-2025-30239

CVE-2025-30239 affects TP-Link Aginet devices where hardcoded cryptographic keys in firmware can be recovered from device storage, enabling decryption of stored data and access to sensitive configuration information (including credentials). Exploitation details and fixes are not provided in the a...