CVE-2026-91076 is a vulnerability in the Robokassa payment gateway plugin for WooCommerce versions before 1.9.0. The plugin fails to verify the authenticity of incoming payment-notification requests, allowing unauthenticated attackers to mark any WooCommerce order as failed. Since order identifiers are sequential, attackers can systematically disrupt order fulfillment by targeting orders one by one.
CVE-2026-108064 is a vulnerability in the WP Encryption WordPress plugin versions before 7.8.8.2. It lacks proper authorization checks on a handler involved in SSL certificate provisioning, allowing unauthenticated users to overwrite the site's certificate private key and replace pending Let's Encrypt order and challenge data. This can disrupt certificate issuance by repeatedly regenerating challenge material, preventing administrators from completing the process.
CVE-2026-107158 is a medium severity vulnerability in the LTL Freight Quotes WordPress plugin before version 4.2.19. It lacks authorization checks on a REST route that writes to the database, allowing unauthenticated users to modify some stored settings of the plugin.
The Classified Listing WordPress plugin versions before 6.1.1 contain a missing authorization vulnerability. This flaw allows any authenticated user with a subscriber-level account to modify, corrupt, or delete media-library attachments owned by other users, including administrators, by exploiting gallery requests referencing unattached media items. The vulnerability arises because the plugin does not verify ownership or edit permissions for the target listing in such requests.
CVE-2026-105975 is a missing authorization vulnerability in the CamPay Shortcode Payment Gateway WordPress plugin versions before 1.7. The plugin fails to verify the authenticity of Mobile Money payment confirmations and relies on client-supplied parameters to determine payment status. This flaw allows unauthenticated attackers to mark payment records as paid, delete genuine payment records, and write plugin metadata onto arbitrary posts.
CVE-2026-104751 is a vulnerability in the Rank Math SEO WordPress plugin versions before 1.0.280. The plugin fails to perform capability or nonce checks before allowing the clearing of stored SEO analysis data. This flaw allows unauthenticated users to delete SEO analysis data without authorization.
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin contains an authorization bypass vulnerability in all versions up to and including 8.10.2.1. Authenticated users with subscriber-level access or higher can delete business directory listings owned by other users, including posts in published, draft, or private status. The plugin fails to properly verify user authorization, and the nonces used do not provide an effective authorization barrier because they are exposed to all logged-in users.
The Booking Package plugin for WordPress up to version 1.7.29 has an authorization bypass vulnerability. This flaw allows unauthenticated attackers to access personally identifiable information of all booked customers, including names, emails, phone numbers, addresses, and cancellation tokens. The vulnerability arises because the plugin fails to properly verify user authorization. The nonce intended to protect the endpoint is a public CSRF token exposed on pages using the booking_package shortcode or widget, making it easily accessible to attackers.
CVE-2026-56826 is a missing authorization vulnerability in shopperlabs shopper versions 2.0.0 through 2.9.1. Authenticated users with access to the Settings pages but limited privileges could invoke destructive delete actions via Livewire endpoints without proper server-side authorization checks. This flaw allows deletion of carrier options, shipping zones, tax zones, and tax rates, potentially disrupting checkout shipping, payment-method mapping, and tax calculations. The issue is fixed in version 2.9.2.
CVE-2026-103560 is a vulnerability in Microsoft Windows Server 2012 DNS Server involving missing authorization. This flaw allows an authorized local attacker to tamper with the DNS Server due to improper authorization checks. The issue affects multiple Windows Server 2012 and later versions prior to specific fixed releases. A patch is available and has been officially released by Microsoft.
CVE-2026-100217 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and related builds that involves improper privilege management in Windows Group Policy. This flaw allows an authorized local attacker to elevate their privileges. The issue affects multiple Windows 10 versions prior to specific fixed releases. Microsoft has issued official fixes for the affected versions.
CVE-2026-96926 is a missing authorization vulnerability in the DNS Server component of Microsoft Windows 10 Version 1607 and related versions. It allows an authorized attacker with local access to perform tampering actions due to insufficient authorization checks. The vulnerability has been assigned a medium severity with a CVSS score of 5.5. Official patches have been released to address this issue in multiple Windows versions.
CVE-2026-88135 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and related builds. It involves improper access control in the WebDAV component, allowing an authorized local attacker to elevate privileges. The flaw affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official patches to address this issue.
CVE-2026-83568 is a high-severity vulnerability in Microsoft Windows 11 Version 24H2 involving improper access control in kernel-mode drivers. This flaw allows an authorized local attacker to elevate privileges. The issue affects multiple builds of Windows 11 24H2 prior to specific fixed versions. Microsoft has released official patches to address this vulnerability.
CVE-2026-96855 is a medium-severity vulnerability in Microsoft Windows 10 Version 1809 involving improper access control in the Windows Modern Device Management (MDM) component. This flaw allows an authorized local attacker to perform tampering actions due to missing authorization checks. The issue affects multiple Windows 10 builds prior to their respective fixed versions. An official fix is available from Microsoft.
CVE-2026-96316 is a medium severity vulnerability in Microsoft Windows 10 Version 1607 and related builds involving improper access control in the Routing and Remote Access Service (RRAS). This flaw allows an authorized local attacker to perform tampering actions due to missing authorization checks. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. An official fix is available from Microsoft.
CVE-2026-96315 is a missing authorization vulnerability in the Windows Overlay Filter component of Microsoft Windows 10 Version 1607 and related builds. It allows an authorized local attacker to perform tampering actions. The vulnerability has a medium severity score of 5.5 and has been officially fixed in multiple Windows 10 builds.
CVE-2026-96311 is a vulnerability in Microsoft Windows 10 Version 1607 involving improper authorization in the Windows Network List Service. This flaw allows an authorized local attacker to perform tampering actions. The issue affects multiple Windows 10 builds prior to specific fixed versions. A patch is available from Microsoft to address this vulnerability.
CVE-2026-88198 is a high-severity vulnerability in Microsoft SharePoint Server Subscription Edition involving missing authorization. It allows an authorized attacker to elevate privileges over a network. The issue affects versions from 16.0.0 up to but not including 16.0.20326.20190. An official fix is available in version 16.0.20326.20190.
CVE-2026-87714 is a vulnerability in Microsoft Windows 10 Version 1607 and other versions that involves missing authorization in the WebDAV component. This flaw allows an authorized attacker to bypass a security feature over a network. The issue affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official fixes for this vulnerability.