WP DSGVO Tools (GDPR) <= 3.1.23 - Unauthenticated Arbitrary Post Deletion

WP DSGVO Tools GDPR = 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanentl...

CVE-2026-83555

The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know...

CVE-2026-83555

The Email Subscribers & Newsletters WordPress plugin (versions before 5.9.35 ) is vulnerable to an unauthenticated subscription status change . The root cause is a failure to verify the per-subscriber management token when updating subscription statuses. This allows unauthenticated users to force...

EUVD-2026-85031

The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know...

CVE-2026-83555 Email Subscribers by Icegram Express < 5.9.35 - Unauthenticated Subscription Status Change via Missing Token Verification

The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know...

CVE-2026-83555: Missing Authorization

The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know...

PT-2026-97167

Name of the Vulnerable Software and Affected Versions Email Subscribers & Newsletters WordPress plugin versions prior to 5.9.35 Description The plugin fails to verify the per-subscriber management token when modifying a subscriber's subscription status. This allows unauthenticated users to...

CVE-2026-61633

NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nnimqttmsgdecodeunsubscribe in nng/src/supplemental/mqtt/mqttcodec.c does not handle a failed readuint16 while counting topics in a malformed UNSUBSCRIBE packet. A zero-length topic followed by trailing data can leave buf.curp...

CVE-2026-61633 NanoMQ: Infinite Loop in UNSUBSCRIBE Decoder Leading to Remote DoS

NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nnimqttmsgdecodeunsubscribe in nng/src/supplemental/mqtt/mqttcodec.c does not handle a failed readuint16 while counting topics in a malformed UNSUBSCRIBE packet. A zero-length topic followed by trailing data can leave buf.curp...

EUVD-2026-83048

NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nnimqttmsgdecodeunsubscribe in nng/src/supplemental/mqtt/mqttcodec.c does not handle a failed readuint16 while counting topics in a malformed UNSUBSCRIBE packet. A zero-length topic followed by trailing data can leave buf.curp...

CVE-2026-61633 NanoMQ: Infinite Loop in UNSUBSCRIBE Decoder Leading to Remote DoS

NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nnimqttmsgdecodeunsubscribe in nng/src/supplemental/mqtt/mqttcodec.c does not handle a failed readuint16 while counting topics in a malformed UNSUBSCRIBE packet. A zero-length topic followed by trailing data can leave buf.curp...

CVE-2026-61633 NanoMQ: Infinite Loop in UNSUBSCRIBE Decoder Leading to Remote DoS

NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nnimqttmsgdecodeunsubscribe in nng/src/supplemental/mqtt/mqttcodec.c does not handle a failed readuint16 while counting topics in a malformed UNSUBSCRIBE packet. A zero-length topic followed by trailing data can leave buf.curp...

CVE-2026-61633: Loop with Unreachable Exit Condition

NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nnimqttmsgdecodeunsubscribe in nng/src/supplemental/mqtt/mqttcodec.c does not handle a failed readuint16 while counting topics in a malformed UNSUBSCRIBE packet. A zero-length topic followed by trailing data can leave buf.curp...

GO-2026-6309 Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe in github.com/hatchet-dev/hatchet

Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe in github.com/hatchet-dev/hatchet...

GHSA-8X7X-83CF-C3PG Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe

Summary A cross-tenant write / DoS vulnerability in the Hatchet Dispatcher gRPC service allows any holder of a normal tenant-scoped API token the lowest credential Hatchet issues — an OWNER of a brand-new tenant to overwrite the affinity labels of, or disconnect from the dispatcher, any worker UU...

Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe

Summary A cross-tenant write / DoS vulnerability in the Hatchet Dispatcher gRPC service allows any holder of a normal tenant-scoped API token the lowest credential Hatchet issues — an OWNER of a brand-new tenant to overwrite the affinity labels of, or disconnect from the dispatcher, any worker UU...

CVE-2026-54746 Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From 0.40.0 until 0.91.1, the Dispatcher gRPC service does not verify that a request's worker ID belongs to the tenant identified by the bearer-token context in Dispatcher/UpsertWorkerLabels and...

CVE-2026-78139

The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product...

EUVD-2026-66884

The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product...

CVE-2026-10685 Use-after-free of GATT subscribe params in Bluetooth host CCC-write response handler

The Zephyr Bluetooth GATT client CCC-write response handler gattwritecccrsp in subsys/bluetooth/host/gatt.c invoked the application's params-subscribe callback after it had already called params-notifyconn, params, NULL, 0. Per the public GATT API, a notify callback with NULL data is the document...