PT-2026-93307

The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber...

CVE-2026-47780: Improper Input Validation

free5GC is an open-source implementation of the 5G core network. In 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscriptions in free5gc/udr internal/sbi/apidatarepository.go validate the ueId path value with a regular expression whose final .+ alternative accepts every...

Astra Linux – Vulnerability in Zeromq3

A flaw was discovered in the ZeroMQ server in versions prior to 4.3.3. This flaw allows a malicious client to cause a stack buffer overflow on the server by sending crafted topic subscription requests and then unsubscribing. The greatest threat posed by this vulnerability is to confidentiality,...

EUVD-2026-77009

S2OPC through 1.7.3 contains a null pointer dereference in msgsubscriptionpublishbsallocnotificationmessageitems where a failed allocation for DataChangeNotification is overwritten by a successful allocation for EventNotificationList. Attackers can trigger heap allocation failures on sessions wit...

CVE-2026-90507

A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. Affected is the function getsurgesubscription of the file services/subscription.py of the component Subscription Handler. Such manipulation of the argument key leads to improper access...

CVE-2026-90507

CVE-2026-90507 affects the vvbbnn00 WARP-Clash-API (up to commit c7bf236), specifically the get_surge_subscription function in services/subscription.py (Subscription Handler component). Improper manipulation of the key argument leads to improper access control , exploitable remotely without authe...

CVE-2026-90507 vvbbnn00 WARP-Clash-API Subscription subscription.py get_surge_subscription access control

A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. Affected is the function getsurgesubscription of the file services/subscription.py of the component Subscription Handler. Such manipulation of the argument key leads to improper access...

EUVD-2026-76980

A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. Affected is the function getsurgesubscription of the file services/subscription.py of the component Subscription Handler. Such manipulation of the argument key leads to improper access...

CVE-2026-90507 vvbbnn00 WARP-Clash-API Subscription subscription.py get_surge_subscription access control

A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. Affected is the function getsurgesubscription of the file services/subscription.py of the component Subscription Handler. Such manipulation of the argument key leads to improper access...

CVE-2026-88764 Simple Membership < 4.7.8 - Subscriber+ Membership Level Escalation via PayPal Standard subsc_ref

The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button, allowing members to pay for a lower-priced membership while being granted a higher, more privileged...

PT-2026-90823

Name of the Vulnerable Software and Affected Versions vvbbnn00 WARP-Clash-API versions up to c7bf2360073959861219b422e51ae86411051b46 Description Improper access controls exist in the Subscription Handler component. A remote attacker can manipulate the key argument within the get surge subscripti...

PT-2026-90857

S2OPC through 1.7.3 contains a null pointer dereference in msg subscription publish bs alloc notification message items where a failed allocation for DataChangeNotification is overwritten by a successful allocation for EventNotificationList. Attackers can trigger heap allocation failures on...

CVE-2026-90507: Improper Access Control

A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. Affected is the function getsurgesubscription of the file services/subscription.py of the component Subscription Handler. Such manipulation of the argument key leads to improper access...

CVE-2026-87719

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance...

CVE-2026-87719

GitLab Enterprise Edition (EE) is affected by an insecure deserialization flaw in the GraphQL subscription serializer . An authenticated user with Duo Chat access can craft a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup, exposing Advance...

CVE-2026-87719 Deserialization of Untrusted Data in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance...

CVE-2026-87719 Deserialization of Untrusted Data in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance...

CVE-2026-87719: Deserialization of Untrusted Data

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance...

Apache ActiveMQ < 5.19.11 / 6.x < 6.3.2 clientId Spoofing

The version of Apache ActiveMQ running on the remote host is prior to 5.19.11 or 6.x prior to 6.3.2. It is, therefore, affected by a spoofing vulnerability: - Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An...

artemis-server: artemis-server: Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0

A missing authentication vulnerability was found in Apache ActiveMQ Artemis. The SUBSCRIBETOPOLOGYV2 handler in CoreProtocolManager.LocalChannelHandler.handlePacket processes topology subscription requests on channel0 with zero authentication -- no call to getSecurityStore, no credential...