CVE-2026-72586

A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, et...

EUVD-2026-55247

TLS hostname verification issue in Apache Ranger Client Code in versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-65942 Apache Ranger: Clients accept TLS certificates issued for other hostnames

TLS hostname verification issue in Apache Ranger Client Code in versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-65942

CVE-2026-65942 concerns TLS hostname verification in Apache Ranger Client Code for versions

CVE-2026-18469

The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data, allowing unauthenticated attackers to reset the limit at will...

CVE-2026-18468

The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of...

CVE-2026-17021

The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings...

CVE-2026-17012

The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Validates the owner of the durable handle upon reconnection. Currently, ksmbd does not verify whether the user attempting to reconnect to a durable handle is the same user who originally opened the file. This allows any...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ext4: xattr: fixed a null pointer derefrence in ext4raw inode If ext4getinodeloc fails e.g., if it returns -EFSCORRUPTED, iloc.bh will remain set to NULL. Since ext4xattr inodedecrefall lacks error checking, this will lead to a...

EUVD-2026-54996

The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, allowing authenticated users, with Subscriber-level access and above, to modify the profile details of arbitrary users, including administrators...

CVE-2026-17021

The Salon Booking System WordPress plugin through 10.30.33 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary bookings...

CVE-2026-17020

The Salon Booking System WordPress plugin through 10.30.33 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user including a Subscriber or self-registered customer account to disclos...

CVE-2026-18934

CVE-2026-18934 affects the RSS Aggregator by Feedzy WordPress plugin up to version 5.2.5 (pre-5.2.6). The vulnerability arises because the plugin does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and ab...

CVE-2026-17012

The CVE-2026-17012 affects the WordPress plugin “Accept PayPal & Stripe with Subscriptions for WooCommerce” up to version 3.1.0. The underlying issue is that the plugin does not verify that the PayPal account receiving a payment matches the merchant’s configured account before marking the order a...

CVE-2026-17012

The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order...

CVE-2026-18469

The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data, allowing unauthenticated attackers to reset the limit at will...

CVE-2026-18468

The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of...

CVE-2026-17012 Restore PayPal Standard for WooCommerce <= 3.1.0 - Payment Bypass via Unvalidated receiver_email

The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order...

CVE-2026-18468 Login & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Verification State Keyed on a Client-Supplied Address Header

The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of...