CVE-2026-82553 is an improper authorization vulnerability in the sambitraj Student Management System affecting the mysqli_query function in student_dashboard.php. The issue arises from manipulation of the roll_no argument, allowing unauthorized access. The vulnerability can be exploited remotely and public exploit code is available. The product uses a rolling release system, so specific affected or fixed versions are not disclosed. The vendor has been informed but has not yet responded or provided a fix. The CVSS score is 5.3, indicating medium severity.
CVE-2026-78271 is a high-severity vulnerability in WP Manage Ninja's FluentCRM Pro plugin, affecting versions up to and including 3.1.12. It involves incorrect privilege assignment that allows an editor-level user to escalate privileges. This flaw could lead to full compromise of confidentiality, integrity, and availability of the affected system. No official patch or remediation guidance has been provided yet.
CVE-2026-32566 is a critical vulnerability in the ACPT (Pro) - Custom Post Types Plugin for WordPress, affecting versions up to 2.0.63. It allows unauthenticated users to escalate privileges due to incorrect privilege assignment (CWE-266). The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-78267 is a critical vulnerability in Cozmoslabs TranslatePress versions up to and including 3.3.2. It allows unauthenticated users to escalate privileges due to incorrect privilege assignment (CWE-266). The vulnerability has a CVSS score of 9.8, indicating a high impact on confidentiality, integrity, and availability.
CVE-2026-32561 is a high-severity vulnerability in LiquidThemes Booking Hub versions up to and including 1.3.0. It involves incorrect privilege assignment that allows subscriber privilege escalation. The flaw is categorized under CWE-266, indicating improper access control. No official patch or remediation guidance is currently available from the vendor. The vulnerability has not been reported as exploited in the wild.
HCL Hive version 1.0 is affected by a broken access control vulnerability (CWE-266) that could allow an attacker with high privileges to introduce unverified or malicious code directly into production environments. This vulnerability has a high severity with a CVSS score of 7.2. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-66648 is a critical vulnerability in MVPThemes Jawn affecting versions up to and including 1.4.2. It allows unauthenticated users to escalate privileges due to incorrect privilege assignment (CWE-266). The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.
CVE-2026-32558 is a critical unauthenticated privilege escalation vulnerability in the Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin, affecting versions up to and including 8.9.1. This flaw allows an attacker to gain elevated privileges without authentication, potentially leading to full compromise of the affected system.
CVE-2026-28165 is a critical vulnerability in UnitedOver, LLC Digits software versions up to and including 9.2. It allows unauthenticated users to escalate privileges due to incorrect privilege assignment (CWE-266). The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
SourceCodester Class and Exam Timetabling System version 1.0 contains an authorization vulnerability in the /admin/edit_user_account.php component. An attacker with limited privileges can manipulate the id or username parameters to modify user accounts without proper authorization. The vulnerability is remotely exploitable. No patch or official remediation is currently available.
CVE-2026-75910 is a vulnerability in the ClickHouse connector deployment template for Amazon Athena Federated Query prior to version 2026.17.1. It involves incorrect privilege assignment that could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account. This occurs if the attacker points the connector's connection string to an unrelated secret and a database endpoint under their control, causing the secret to be transmitted to that endpoint. The issue is fixed in version 2026.17.1. Users should upgrade to this version or later, or redeploy the connector with the current template and specify a non-empty SecretNamePrefix value to mitigate the risk.
A critical vulnerability (CVE-2026-11861) was found in FreeIPA when a trust relationship is configured between FreeIPA and Active Directory. This flaw allows Active Directory users to obtain Ticket Granting Service (TGS) tickets with impersonating canonical names, potentially leading to unauthorized access. The issue is part of a broader set of security fixes addressing multiple vulnerabilities in FreeIPA, including unauthenticated denial of service, cross-site scripting, privilege escalation, and unauthorized LDAP writes. Red Hat has released updates for Red Hat Enterprise Linux 9 and related products to address these issues.
CVE-2026-66682 is a critical vulnerability in Tyche Softwares' Abandoned Cart Pro for WooCommerce plugin, affecting versions up to and including 10.4.0. It allows unauthenticated users to escalate privileges incorrectly due to improper privilege assignment. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
CVE-2025-15689 is a critical unauthenticated privilege escalation vulnerability in ThemeGoods Capella affecting versions up to and including 2.5.5. It allows an attacker with no prior authentication to gain elevated privileges, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-73390 is a critical vulnerability in KlbTheme's Total Donations plugin versions up to and including 2.0.5. It allows unauthenticated users to escalate privileges incorrectly due to improper privilege assignment (CWE-266). The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
CVE-2026-73347 is a critical vulnerability in ThemetechMount's TrueBooker software versions up to and including 1.2.6. It allows unauthenticated users to escalate privileges due to incorrect privilege assignment. The vulnerability has a very high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.