CVE-2026-92540: Improper Privilege Management

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promoteusers capability when assigning roles during a CSV import, allowing users with only the createusers capability to create new administrator accounts or promote existing users to...

CVE-2026-92423: Exposure of Sensitive Information to an Unauthorized Actor

The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returning post data, allowing authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other...

CVE-2026-16542: Server-Side Request Forgery (SSRF)

The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks...

PT-2026-95914

Name of the Vulnerable Software and Affected Versions Import and export users and customers WordPress plugin versions prior to 2.4.5 Description High-privileged users can perform Server-Side Request Forgery SSRF attacks during a CSV import. This occurs because the plugin fails to validate a...

CVE-2026-92403

The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor, allowing unauthenticated users to submit against a different registered form and modify the title and content of the post that...

CLEANSTART-2026-ZF70449 flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution

Security vulnerability affects the keycloak package. A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution...

PT-2026-95872

Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.1 Description Authenticated back-office users can read arbitrary files due to a path traversal issue in the getEmailHTML action of the 'admin/ajax.php' endpoint. By providing relative path sequences in the email...

PT-2026-95750

Name of the Vulnerable Software and Affected Versions Business Name Generator WordPress plugin versions prior to 1.4 Description Insufficient sanitization and escaping of certain settings allow high-privilege users, such as administrators, to execute Stored Cross-Site Scripting XSS attacks. This...

CVE-2026-93988: Improper Limitation of a Pathname to a Restricted Directory

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...

CVE-2026-61670 microsandbox: Secret values exposed in world-readable process arguments

microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments accepted by crates/cli/lib/sandboxcmd.rs...

CVE-2026-61670 microsandbox: Secret values exposed in world-readable process arguments

microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments accepted by crates/cli/lib/sandboxcmd.rs...

CVE-2026-93872

Cotonti 1.0.0 is affected by a PHP object injection vulnerability in the comments plugin EditAction . The base64-decoded cb parameter is passed directly to unserialize() without an allowed_classes restriction, allowing registered users with comment write permissions to instantiate arbitrary PHP o...

CVE-2026-93870 Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated users. Attackers can craft malicious pages that auto-submit POST requests to modify stored rating data when visited by logged-in users...

CVE-2026-10030 IBM MQ Console is vulnerable to privilege escalation

IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks...

CVE-2026-10030

IBM MQ versions 9.3 LTS, 9.4 LTS, 9.3 CD, 9.4 CD, and 10.0.0.0 are affected by an improper authorization flaw (CWE-285) in the REST API and Console component. An authenticated non-administrative user with only read-only console access can create and start queue managers on the host, leading to pr...

CVE-2026-40530

An improper neutralization of CRLF sequences 'CRLF injection' vulnerability in User API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks after the...

CVE-2026-40537

A server-side request forgery (SSRF) vulnerability exists in the PersonMail API component of Synology DiskStation Manager (DSM) prior to versions 7.2.1-69057-10 , 7.2.2-72806-7 , and 7.3.2-86009-2 . A remote authenticated user can leverage this flaw to obtain non-sensitive information . The vulne...

EUVD-2026-82789

An improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Video API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write limited files when the player is launched...

CVE-2026-40532

A direct request 'forced browsing' vulnerability in Wallpaper Path in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain sensitive information...

CVE-2026-4036

An improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Sharing API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain arbitrary sharing files...