🚨 CVE-2026-25269
Memory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated memory size.
🎖@cveNotify
Memory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated memory size.
🎖@cveNotify
🚨 CVE-2026-25270
Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver.
🎖@cveNotify
Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver.
🎖@cveNotify
🚨 CVE-2026-25272
Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation.
🎖@cveNotify
Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation.
🎖@cveNotify
🚨 CVE-2026-25273
Memory Corruption when processing camera operations due to out-of-bounds write during driver updates.
🎖@cveNotify
Memory Corruption when processing camera operations due to out-of-bounds write during driver updates.
🎖@cveNotify
🚨 CVE-2026-25274
Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization.
🎖@cveNotify
Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization.
🎖@cveNotify
🚨 CVE-2026-25291
Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms.
🎖@cveNotify
Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms.
🎖@cveNotify
🚨 CVE-2026-25302
Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.
🎖@cveNotify
Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.
🎖@cveNotify
🚨 CVE-2026-57537
Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization.
🎖@cveNotify
Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization.
🎖@cveNotify
🚨 CVE-2026-57545
Memory corruption when processing draw objects of incorrect type during graphics command list execution.
🎖@cveNotify
Memory corruption when processing draw objects of incorrect type during graphics command list execution.
🎖@cveNotify
🚨 CVE-2026-57546
Transient DOS when processing a continuous receive command with a zero-sized global configuration override.
🎖@cveNotify
Transient DOS when processing a continuous receive command with a zero-sized global configuration override.
🎖@cveNotify
🚨 CVE-2026-57554
Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.
🎖@cveNotify
Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.
🎖@cveNotify
🚨 CVE-2026-57555
Memory Corruption when executing system service routines due to improper handling of user input buffers.
🎖@cveNotify
Memory Corruption when executing system service routines due to improper handling of user input buffers.
🎖@cveNotify
🚨 CVE-2026-59358
Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged client_credentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer credential on a client_credentials grant request in place of the client’s configured secret.
UAA’s client_credentials handling does not verify that the Bearer credential supplied for client authentication is actually a client credential (a client secret or a valid configured client authentication method); it accepts any valid access token whose client_id matches the request. A token obtained by a normal end user through a public authorization_code + PKCE flow — scoped only to uaa.user, carrying a user_id, and recording client_auth_method=none — satisfies this check. That user token cannot itself administer OAuth clients (POST /oauth/clients correctly returns 403), but when replayed as Bearer authentication on a client_credentials request for the same client, UAA issues a new client-only token carrying the client’s full authorities, such as clients.write. An attacker can use that token to create arbitrary new OAuth clients, including clients with attacker-chosen authorities, without ever possessing the client’s actual secret.
Exploitation requires a valid user access token (the attacker’s own) for a client that is configured to support both a public, user-facing authorization flow and the client_credentials grant type on the same client_id — a non-default combination. Practical impact scales with the authorities assigned to that client.
🎖@cveNotify
Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged client_credentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer credential on a client_credentials grant request in place of the client’s configured secret.
UAA’s client_credentials handling does not verify that the Bearer credential supplied for client authentication is actually a client credential (a client secret or a valid configured client authentication method); it accepts any valid access token whose client_id matches the request. A token obtained by a normal end user through a public authorization_code + PKCE flow — scoped only to uaa.user, carrying a user_id, and recording client_auth_method=none — satisfies this check. That user token cannot itself administer OAuth clients (POST /oauth/clients correctly returns 403), but when replayed as Bearer authentication on a client_credentials request for the same client, UAA issues a new client-only token carrying the client’s full authorities, such as clients.write. An attacker can use that token to create arbitrary new OAuth clients, including clients with attacker-chosen authorities, without ever possessing the client’s actual secret.
Exploitation requires a valid user access token (the attacker’s own) for a client that is configured to support both a public, user-facing authorization flow and the client_credentials grant type on the same client_id — a non-default combination. Practical impact scales with the authorities assigned to that client.
🎖@cveNotify
Cloud Foundry
CVE-2026-59358 - UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type. | Cloud…
Severity High CVSS score: 7.6 (High) (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N) Vendor Cloud Foundry Foundation Versions Affected *Severity is High unless otherwise noted. UAA – All versions from UAA v3.7.0 to v79.6.0 (inclusive); …
🚨 CVE-2026-86786
The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as well as post revisions and media metadata.
🎖@cveNotify
The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as well as post revisions and media metadata.
🎖@cveNotify
WPScan
Slider Pro <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via sliderpro_multiple_images
See details on Slider Pro <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via sliderpro_multiple_images CVE 2026-86786. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-89289
The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id.
🎖@cveNotify
The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id.
🎖@cveNotify
WPScan
Fast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint
See details on Fast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint CVE 2026-89289. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-94270
The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verification disabled by default, allowing unauthenticated attackers to mark an unpaid order as paid, or to cancel or refund an existing order.
🎖@cveNotify
The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verification disabled by default, allowing unauthenticated attackers to mark an unpaid order as paid, or to cancel or refund an existing order.
🎖@cveNotify
WPScan
Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass and Order Manipulation via Webhook
See details on Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass and Order Manipulation via Webhook CVE 2026-94270. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-94271
The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being taken.
🎖@cveNotify
The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being taken.
🎖@cveNotify
WPScan
Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success Return
See details on Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success Return CVE 2026-94271. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-94278
The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored site data that referenced the old file path.
🎖@cveNotify
The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored site data that referenced the old file path.
🎖@cveNotify
WPScan
File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat
See details on File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat CVE 2026-94278. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2026-94293
An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.
🎖@cveNotify
An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.
🎖@cveNotify
Certvde
Murrelektronik: Missing Authentication in aas-edge-client Reference Implementation allows Manipulation of AAS Data
🚨 CVE-2026-94299
The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where that secret has been left at its default empty value.
🎖@cveNotify
The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where that secret has been left at its default empty value.
🎖@cveNotify
WPScan
elegro Crypto Payment <= 1.0.1 - Unauthenticated Arbitrary Order Status Change via IPN Callback
See details on elegro Crypto Payment <= 1.0.1 - Unauthenticated Arbitrary Order Status Change via IPN Callback CVE 2026-94299. View the latest Plugin Vulnerabilities on WPScan.