CVE-2026-16575 Dokan < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict access to per-vendor commission configuration returned by one of its unauthenticated store REST endpoints, allowing any unauthenticated user to disclose a vendor's commission type...

SUSE CVE-2026-74942

Privilege escalation in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

SUSE CVE-2026-75874

Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 140.15, and Thunderbird 153.2...

CVE-2026-75874

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape in the Remote Settings Client component...

PT-2026-79439

Name of the Vulnerable Software and Affected Versions Craftplan versions prior to 0.5.1 Description Broken access control allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. By sending a GET request to the...

CVE-2026-76876: Missing Authorization

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record...

Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings

Summary The ApplicationName and LogoURL appearance settings were rendered into HTML output without sufficient escaping which let a highly privileged Owner-role user inject HTML into the Coder dashboard and SMTP notification emails. Note: Exploitation requires the Owner role which already holds fu...

GHSA-H58C-XCCX-75M3 Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings

Summary The ApplicationName and LogoURL appearance settings were rendered into HTML output without sufficient escaping which let a highly privileged Owner-role user inject HTML into the Coder dashboard and SMTP notification emails. Note: Exploitation requires the Owner role which already holds fu...

WordPress Clearfy plugin < 2.4.3 - Admin+ PHP Object Injection via Settings Import vulnerability

Admin+ PHP Object Injection via Settings Import vulnerability discovered by Omar Elshopky in WordPress Plugin Clearfy Cache versions 2.4.3...

CVE-2026-76256

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read sensitive Security Assertion Markup Language setup and instance settings information...

CVE-2026-12634

In Zephyr's settings NVS backend (subsys/settings/src/settings_nvs.c), three functions (settings_nvs_cache_match, settings_nvs_load, settings_nvs_save) use the nvs_read() return value directly as a NUL-terminator index into 74-byte stack buffers without clamping, causing a single-byte out-of-boun...

CVE-2026-12634 Out-of-bounds stack write in the settings NVS backend from over-reported nvs_read length

The NVS backend of the Zephyr settings subsystem subsys/settings/src/settingsnvs.c reads stored setting-name entries into fixed 74-byte stack buffers and NUL-terminates them with bufrc = '\0', where rc is the return value of nvsread. Per its contract, nvsread returns the full stored entry length...

CVE-2026-12634 Out-of-bounds stack write in the settings NVS backend from over-reported nvs_read length

The NVS backend of the Zephyr settings subsystem subsys/settings/src/settingsnvs.c reads stored setting-name entries into fixed 74-byte stack buffers and NUL-terminates them with bufrc = '\0', where rc is the return value of nvsread. Per its contract, nvsread returns the full stored entry length...

CVE-2026-53547 Termix: Account Takeover via Global Settings Disclosure

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table...

CVE-2026-53547

A low-privileged authenticated user on Termix (prior to 2.3.2) can call POST /database/export to retrieve a global settings table containing reset_code_ and temp_reset_token_ artifacts for other accounts, enabling account takeover and admin compromise via the normal password-reset flow. Upgrade t...

CVE-2026-53547 Termix: Account Takeover via Global Settings Disclosure

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table...

CVE-2026-53547 Termix: Account Takeover via Global Settings Disclosure

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table...

CVE-2026-45273 MyBooks: Privilege Escalation via Missing Authorization on Admin Settings Endpoint

MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserver/handlers/admin.py applies the auth decorator but does not check the self.adminuser property, unlike the corresponding GET handler. Any...

CVE-2026-45273 MyBooks: Privilege Escalation via Missing Authorization on Admin Settings Endpoint

MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserver/handlers/admin.py applies the auth decorator but does not check the self.adminuser property, unlike the corresponding GET handler. Any...

CVE-2026-45273 MyBooks: Privilege Escalation via Missing Authorization on Admin Settings Endpoint

MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserver/handlers/admin.py applies the auth decorator but does not check the self.adminuser property, unlike the corresponding GET handler. Any...