CVE-2026-105120 OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint

OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessions of every realm. Attackers holding delegated RealmAdmin privileges can supply a queryFilter naming another realm to disclose usernames...

CVE-2026-105120 OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint

OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessions of every realm. Attackers holding delegated RealmAdmin privileges can supply a queryFilter naming another realm to disclose usernames...

CVE-2026-105120 OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint

OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessions of every realm. Attackers holding delegated RealmAdmin privileges can supply a queryFilter naming another realm to disclose usernames...

CVE-2026-105117 OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions

OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording via the forgotPassword and register actions on /json/realm/users. Attackers can supply subject and message fields to send phishing mail from the...

CVE-2026-86832

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API...

EUVD-2026-91939

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API...

CVE-2026-86832 MetForm < 4.3.1 - Unauthenticated Form Entry Data Disclosure via REST API

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API...

CVE-2026-86832 MetForm < 4.3.1 - Unauthenticated Form Entry Data Disclosure via REST API

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API...

CVE-2026-86832

The MetForm WordPress plugin, specifically versions before 4.3.1 , contains a vulnerability where it fails to properly restrict access to form submission data. This flaw allows unauthenticated attackers to view sensitive submitter information via the REST API . Exploitation details are not provid...

[SECURITY] Fedora 45 Update: rest-0.10.2-13.fc45

This library was designed to make it easier to access web services that claim to be "RESTful". A RESTful service should have urls that represent remote objects, which methods can then be called on. The majority of services don't actually adhere to this strict definition. Instead, their RESTful en...

PT-2026-104525

Name of the Vulnerable Software and Affected Versions MetForm WordPress plugin versions prior to 4.3.1 Description Insufficient access restrictions to form submission data allow unauthenticated attackers to view submitter information via the REST API. Recommendations Update MetForm WordPress plug...

PT-2026-104581

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description An authorization bypass exists in the sessions REST endpoint query operation. This issue allows users with delegated RealmAdmin privileges to list sessions across different realms by supplying a...

CVE-2026-86832: Exposure of Sensitive Information to an Unauthorized Actor

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API...

CVE-2026-105120: Exposure of Sensitive Information to an Unauthorized Actor

OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessions of every realm. Attackers holding delegated RealmAdmin privileges can supply a queryFilter naming another realm to disclose usernames...

CVE-2026-104991

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints singleget, singlecomments, singlecommentspost that allows authenticated API key holders to bypass the security.restrictaccess confidentiality control by never invoking the allowAcces...

EUVD-2026-91776

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints singleget, singlecomments, singlecommentspost that allows authenticated API key holders to bypass the security.restrictaccess confidentiality control by never invoking the allowAcces...

CVE-2026-104991 Phproject < 1.8.7 Missing Authorization via Issues REST API

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints singleget, singlecomments, singlecommentspost that allows authenticated API key holders to bypass the security.restrictaccess confidentiality control by never invoking the allowAcces...

CVE-2026-104991

Phproject versions prior to 1.8.7 are affected by a missing object-level authorization vulnerability within the REST API issue endpoints, specifically single_get, single_comments, and single_comments_post. The root cause is the failure to invoke the allowAccess() authorization routine, allowing a...

CVE-2026-104991 Phproject < 1.8.7 Missing Authorization via Issues REST API

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints singleget, singlecomments, singlecommentspost that allows authenticated API key holders to bypass the security.restrictaccess confidentiality control by never invoking the allowAcces...

CVE-2026-104991 Phproject < 1.8.7 Missing Authorization via Issues REST API

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints singleget, singlecomments, singlecommentspost that allows authenticated API key holders to bypass the security.restrictaccess confidentiality control by never invoking the allowAcces...