CVE Notifier

CVE-2026-87831 CWE-862 4.3

Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Customer Address Custom Field

The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer…

WPScan Unknown:Checkout · Field · Manager 6 hari lalu

CVE-2026-87829 CWE-639 4.3

Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Unvalidated Attachment ID Reparenting

The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer…

WPScan Unknown:Checkout · Field · Manager 6 hari lalu

CVE-2026-50605 CWE-284 N/A

Privilege Escalation Vulnerability in NitroSense and PredatorSense Software

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. Insufficient access controls within a privileged service may allow an authenticated local user to perfor…

cve.org Acer:Agent · Serivce 6 hari lalu

CVE-2026-86320 CWE-94 7.8

Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the h…

cve.org Red · Hat:Red · Hat 6 hari lalu

CVE-2026-91017 CWE-? 3.7

Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via Forged JWT Callback

The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenti…

WPScan Unknown:Robokassa · payment · gateway 6 hari lalu

CVE-2026-87963 CWE-? 8.6

Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthe…

WPScan Unknown:Yo 6 hari lalu

CVE-2026-86801 CWE-? 8.8

To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, File Listing and Deletion via Unprotected Upload Handler

The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the…

WPScan Unknown:To · Do · List 6 hari lalu

CVE-2026-90982 CWE-178 5.3

@fastify/static vulnerable to route guard bypass via path case-folding

@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or all…

cve.org @fastify/static:@fastify/static 6 hari lalu

CVE-2026-44940 CWE-312 5.7

Service token exposure and potential privilege escalation in SUSE Observability

The rancher-extension-stackstate extension in SUSE Observability exposes service tokens in plain configuration or insecure locations rather than managing them securely. An attacker with minimal access could obtain the to…

cve.org SUSE:SUSE · Observability 6 hari lalu

CVE-2026-91019 CWE-? N/A

Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's …

WPScan Unknown:Event · Booking · Manager 6 hari lalu

CVE-2026-91016 CWE-? N/A

Motors < 1.4.121 - Unauthenticated Draft/Private Listing Disclosure

The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowing unauthenticated attackers to read any author's draft, pendi…

WPScan Unknown:Motors 6 hari lalu

CVE-2026-91015 CWE-? N/A

Master Addons for Elementor < 3.1.9 - Unauthenticated Popup Deactivation via jltma_popup_disable_expired

The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to ever…

WPScan Unknown:Master · Addons · for 6 hari lalu