CVE-2026-50608

CVE-2026-50608 affects the Acer System Monitoring component shipped with NitroSense and PredatorSense software. The root cause is an improperly implemented WebSocket handshake that does not require authentication before permitting connections to the local service, potentially allowing unauthorize...

CVE-2026-50607

CVE-2026-50607 affects the Acer System Monitoring component bundled with NitroSense and PredatorSense . A WebSocket service was configured to listen on all network interfaces rather than a restricted one, which may expose the service to unintended network access. The CVSS 4.0 base score is 6.9 (M...

CVE-2026-50606

A hard-coded AES encryption key in the Acer System Monitoring component (shipped with NitroSense and PredatorSense) allows a local attacker with no privileges to potentially access protected information or perform unauthorized actions under certain circumstances. The vulnerability is rated CVSS 4...

CVE-2026-87831

CVE-2026-87831 affects the Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin in versions before 7.9.7 . The plugin does not properly validate attachment ownership before deletion, allowing any authenticated user (e.g., a customer) to delete arbitrary media attachments bel...

CVE-2026-87829

Checkout Field Manager (Checkout Manager) for WooCommerce (WordPress plugin) versions before 7.9.7 contain an improper authorization flaw in attachment deletion. The plugin fails to properly validate the ownership of an attachment before allowing its deletion, enabling any authenticated user with...

CVE-2026-50605

CVE-2026-50605 affects the Acer Agent Service component bundled with NitroSense and PredatorSense software. The root cause is insufficient access controls within a privileged service, allowing an authenticated local user to perform unauthorized registry operations, which may lead to privilege esc...

CVE-2026-86320

CVE-2026-86320 affects flatpak-builder , a build tool for creating Flatpak applications. When applying patch sources with use-git-am: true, Git hooks are not disabled, allowing an attacker who supplies a malicious source containing a post-applypatch hook to execute arbitrary code on the host duri...

CVE-2026-91017

CVE-2026-91017 affects the Robokassa payment gateway for WooCommerce WordPress plugin in versions before 1.8.9 . When the plugin's non-default deferred-payment feature is enabled, it fails to verify the authenticity of incoming payment notifications. According to the CVE listing, the mechanism in...

CVE-2026-87963

The Yo WordPress plugin (versions 1.1 through 1.3.1 ) is affected by an unauthenticated SQL injection vulnerability. The plugin does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its built-in request escaping. An ...

CVE-2026-86801

The To Do List Member WordPress plugin (versions 1.4 through 1.6 ) includes a file upload endpoint that fails to load WordPress, meaning no authentication , capability , or nonce checks are enforced. The endpoint validates only the uploaded file's name , not its content , allowing unauthenticated...

CVE-2026-90982

CVE-2026-90982 affects the @fastify/static plugin (versions before 10.1.4 ). On case-insensitive filesystems such as Windows or the default macOS volume, a mismatch between the case-sensitive route matcher and the case-insensitive filesystem allows an unauthenticated attacker to bypass route guar...

CVE-2026-44940

CVE-2026-44940 affects the rancher-extension-stackstate extension in SUSE Observability . The root cause is the exposure of service tokens in plain configuration or insecure locations , rather than storing them in a secure secret management mechanism. An attacker with minimal access (low privileg...

CVE-2026-91019

Event Booking Manager for WooCommerce (also identified as WpEvently ) before version 5.6.0 contains an improper access control flaw: the plugin's stored payment gateway configuration is not restricted by user role. As a result, any user with Contributor-level access or above can read the site's P...

CVE-2026-91014

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 fails to sanitise and escape certain parameters before reflecting them in the page, enabling an unauthenticated reflected XSS attack via the Location Selector Endpoint . An attacker must convince a victim to follow a ...

CVE-2026-91011

The EWWW Image Optimizer WordPress plugin (versions before 8.7.7 ) fails to properly escape image attribute values when rewriting page output, specifically through image class attribute backreference expansion . This allows authenticated users with author-level access or above to inject arbitrary...

CVE-2026-91010

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin (versions 2.0.5–5.1.0 ) contains a missing authorization flaw in its message deletion AJAX action. The plugin checks only that a nonce parameter is present without validating it and does not verify the reques...

CVE-2026-91015

Master Addons for Elementor WordPress plugin (versions 3.0.0–3.1.8 ) suffers from a missing authorization check on the AJAX action jltma_popup_disable_expired , which is used to deactivate Popup Builder popups. The only protection is a nonce publicly output to every visitor , meaning any unauthen...

CVE-2026-91016

The Motors WordPress plugin (a car dealership classified listings plugin) before version 1.4.121 contains an unauthorized disclosure vulnerability . The plugin fails to verify whether a request is authorized to view a user's non-published listings, allowing unauthenticated attackers to read any a...

CVE-2026-90923

CVE-2026-90923 affects the Autopay WordPress plugin in versions before 5.0.1 . The root cause is a missing signature enforcement on one of its payment callback endpoints, which allows unauthenticated users to disclose and delete the stored payment parameters of other customers' orders. The vulner...

CVE-2026-91009

The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before version 2.1.3 lacks authorization and CSRF checks in its AJAX actions, specifically the woot_update_attachment action. This allows any authenticated user at the subscriber level to change the title of arbitrary pos...