PULSEUnderground Intel

LIVE3signals / 24h

FEED

vulnKEV agrega CVE-2025-39964 — Linux / KernelvulnKEV agrega CVE-2026-53266 — Linux / KernelvulnKEV agrega CVE-2025-39682 — Linux / KernelvulnKEV agrega CVE-2026-58704 — Google / PixelvulnKEV agrega CVE-2026-76460 — Cisco / Identity Services EnginevulnKEV agrega CVE-2026-87886 — Acronis / BackupvulnKEV agrega CVE-2026-76461 — Cisco / Secure Email GatewayvulnKEV agrega CVE-2026-84869 — ConnectWise / ScreenConnectvulnKEV agrega CVE-2026-42016 — JFrog / ArtifactoryvulnKEV agrega CVE-2026-42018 — JFrog / ArtifactoryvulnKEV agrega CVE-2026-85706 — GitLab / Community Edition and Enterprise EditionvulnKEV agrega CVE-2026-86060 — MikroTik / RouterOSvulnKEV agrega CVE-2026-67277 — MikroTik / RouterOSvulnKEV agrega CVE-2026-19490 — Citrix / NetScalervulnKEV agrega CVE-2025-39964 — Linux / KernelvulnKEV agrega CVE-2026-53266 — Linux / KernelvulnKEV agrega CVE-2025-39682 — Linux / KernelvulnKEV agrega CVE-2026-58704 — Google / PixelvulnKEV agrega CVE-2026-76460 — Cisco / Identity Services EnginevulnKEV agrega CVE-2026-87886 — Acronis / BackupvulnKEV agrega CVE-2026-76461 — Cisco / Secure Email GatewayvulnKEV agrega CVE-2026-84869 — ConnectWise / ScreenConnectvulnKEV agrega CVE-2026-42016 — JFrog / ArtifactoryvulnKEV agrega CVE-2026-42018 — JFrog / ArtifactoryvulnKEV agrega CVE-2026-85706 — GitLab / Community Edition and Enterprise EditionvulnKEV agrega CVE-2026-86060 — MikroTik / RouterOSvulnKEV agrega CVE-2026-67277 — MikroTik / RouterOSvulnKEV agrega CVE-2026-19490 — Citrix / NetScaler

CVE WatchSep 17, 2026

CVE-2026-74000

Contributor Broken Access Control in Simple Membership <= 4.8.2 versions.

CVSS

5.3

Medium

EPSS

0.2%

p12

KEV

—

Exploit Today

4

0-100

Published: Sep 17, 2026 · Last modified: Sep 17, 2026 · CWE-862

EPSS · 30d

Not enough EPSS history yet.

Technical description

Contributor Broken Access Control in Simple Membership <= 4.8.2 versions.

Official references

patchstack.comhttps://patchstack.com/database/wordpress/plugin/simple-membership/vulnerability/wordpress-simple-membership-plugin-4-8-2-broken-access-control-vulnerability?_s_id=cve

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-546766.5 MED

——5Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot access because src/main/java/com/erudika/scoold/api/ApiController.java in ApiController.getPostReplies() does not apply canAccessSpace before returning data from GET /api/posts/{id}/answers. The issue is reachable when scoold.api_user_access_enabled and scoold.api_enabled are true and a token holder knows or enumerates a private question identifier. Under those conditions, the question endpoint can deny access while the answers endpoint returns the private reply bodies, exposing confidential team or project discussions. This issue is fixed in version 1.69.0.5h CVE-2026-785285.3 MED

——4Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions.23h CVE-2026-740175.3 MED

——4Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.23h CVE-2026-740025.3 MED

——4Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions.23h CVE-2026-666765.3 MED

——4Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.23h CVE-2026-878314.3 MED

——1The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users.1h