Missing Authorization vulnerability in royalnavneet Delete All Comments of wordpress delete-all-comments-of-website allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delete All Comments of wordpre…

▾ Sunlitroyalnavneet · delete-all-comments-of-websiteEPSS 0.38%via NVD

CVE-2026-25267High· 7.8

1mo ago

Memory corruption when non-secure loader rewrites page tables before secure memory initialization.

▾ Twilightqualcomm · qca6698au_firmwareEPSS 0.06%via NVD

CVE-2026-89289Medium· 5.3

1mo ago

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details …

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details …

▾ SunlitEPSS 0.18%via NVD

CVE-2026-39789High· 7.5

1mo ago

Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions.

▾ TwilightWP Manage Ninja · fluent-affiliate-proEPSS 0.20%via NVD

CVE-2026-39599Medium· 4.3

1mo ago

Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions.

▾ Sunlitwallstrdev · wds-mcp-content-managerEPSS 0.15%via NVD

CVE-2026-32582Medium· 6.5

1mo ago

Missing Authorization vulnerability in iatoai IATO MCP iato-mcp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IATO MCP: from n/a through 1.12.0.

▾ Sunlitiatoai · iato-mcpEPSS 0.17%via NVD

CVE-2026-105072High· 7.5

1mo ago

Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions.

▾ TwilightWP Manage Ninja · fluent-booking-proEPSS 0.20%via NVD

CVE-2026-39723High· 7.5

1mo ago

Missing Authorization vulnerability in Green Invoice Morning for WooCommerce wc-gateway-greeninvoice allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Morning for WooCommerce: from n/a through 2.4.1.

Missing Authorization vulnerability in Green Invoice Morning for WooCommerce wc-gateway-greeninvoice allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Morning for WooCommerce: from n/a through 2.4.1.

▾ TwilightGreen Invoice · wc-gateway-greeninvoiceEPSS 0.20%via NVD

CVE-2026-105706Medium· 4.3PoC

1mo ago

A weakness has been identified in SourceCodester Drug Recommendation System 1.0

A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected is an unknown function. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has b…

▾ TwilightSourceCodester · Drug Recommendation SystemEPSS 0.16%via NVD

GHSA-g7fw-3gjp-g5hfMedium· 6.5

1mo ago

OpenClaw: Channel read actions could skip target allowlists

▾ Sunlitopenclaw · @openclaw/msteamsvia GHSA

CVE-2026-103433Medium· 6.9

1mo ago

Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs

Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or cons…

▾ SunlitDocker · Docker BuildxEPSS 0.29%via NVD

CVE-2026-105698Medium· 5.4PoC

1mo ago

Langflow is a tool for building and deploying AI-powered agents and workflows

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not verify flow ownership in the deprecated POST /api/v1/build/{flow_id}/vertices and POST /api/v1/build/{flow_id}/verti…

▾ Twilightlangflow-ai · langflowEPSS 0.22%via NVD

CVE-2026-105696Medium· 6.5

1mo ago

Penpot is an open-source design and prototyping platform

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify that the caller-selected page-id belongs to the link's author…

▾ Sunlitpenpot · penpotEPSS 0.28%via NVD

CVE-2026-105695Medium· 5.9PoC

1mo ago

Penpot is an open-source design and prototyping platform

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticat…

▾ Twilightpenpot · penpotEPSS 0.30%via NVD

CVE-2026-105693Medium· 5.3PoC

1mo ago

Penpot is an open-source design and prototyping platform

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link. A holder …

▾ Twilightpenpot · penpotEPSS 0.28%via NVD

CVE-2026-105680Medium· 6.5

1mo ago

Ghost is a Node.js content management system

Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in version 6.60.0.

▾ SunlitTryGhost · GhostEPSS 0.27%via NVD

CVE-2026-103337Medium· 6.5

1mo ago

Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Ukraine Shipping: from n/a through 1.23.2.

Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Ukraine Shipping: from n/a through 1.23.2.

▾ SunlitKirillbdev · wc-ukr-shippingEPSS 0.21%via NVD

CVE-2026-45524High· 8.8

1mo ago

In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check

In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not neede…

▾ Twilightgoogle · androidEPSS 0.07%via NVD

CVE-2026-105635High· 7.4PoC

1mo ago

Plane is an open-source project management tool

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ uses permission_classes = [AllowAny] and returns the full ProjectMemberInvite record, inc…

▾ Midnightmakeplane · planeEPSS 0.45%via NVD

CVE-2026-103086Medium· 6.5

1mo ago

Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.74.

▾ SunlitStiofan · userswpEPSS 0.23%via NVD

CVE-2026-102383Medium· 6.5

1mo ago

Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lookzy: from n/a through 1.1.14.

▾ SunlitVillaTheme · woo-lookbookEPSS 0.24%via NVD

CVE-2026-97304Medium· 6.5

1mo ago

Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63.

▾ SunlitArraytics · timeticsEPSS 0.20%via NVD

CVE-2026-97309High· 7.1

1mo ago

Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226.

▾ TwilightWebful Creations · computer-repair-shopEPSS 0.22%via NVD

CVE-2026-97303High· 7.6

1mo ago

Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scratch & Win – …

Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scratch & Win – …

▾ TwilightApps Mav · scratch-win-giveaways-for-website-facebookEPSS 0.25%via NVD

GHSA-3cm4-ccvw-6xr6Medium· 4.9

1mo ago

SiYuan: /history/path and /repo/diff/path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*

SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*

▾ Sunlitsiyuan-note · github.com/siyuan-note/siyuan/kernelvia GHSA