CVE-2026-86591 Botiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder REST Route

The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allo...

CLEANSTART-2026-GB37349 flaw was found in the admin REST API of Keycloak, a solution for identity and access management

Security vulnerability affects the keycloak package. A flaw was found in the admin REST API of Keycloak, a solution for identity and access management...

CVE-2026-94000: Missing Authorization

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated...

CVE-2026-9289: Exposure of Sensitive Information to an Unauthorized Actor

The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes jsonld/id, jsonld/http/itemid,...

CVE-2026-94001: Missing Authorization

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from...

PT-2026-95760

Name of the Vulnerable Software and Affected Versions Master Blocks versions prior to 1.5.0 Description An authorization flaw exists in a REST route that allows unauthenticated users to update plugin settings. This includes the ability to modify a value that is output unescaped in the...

PT-2026-95775

Name of the Vulnerable Software and Affected Versions Create plugin for WordPress versions prior to 2.5.4 Description An issue exists where authenticated attackers with author-level access or higher can perform a SQL Injection. This occurs because the order by parameter is not sufficiently escape...

PT-2026-95758

Name of the Vulnerable Software and Affected Versions Botiga Pro versions prior to 1.6.5 Description Lack of authorization checks on a REST route allows unauthenticated users to update arbitrary WordPress options with arbitrary values. This can lead to privilege escalation and full site takeover...

PT-2026-95826

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Admin REST API of Keycloak. The issue resides in the group-membership endpoints, where the system does not verify if a group grants administrative privileges before...

PT-2026-95827

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Admin REST API of Keycloak. The endpoint used for deleting user credentials fails to correctly verify fine-grained reset-password permissions. This allows a delegated...

PT-2026-95805

Name of the Vulnerable Software and Affected Versions WordLift – AI powered SEO – Schema plugin for WordPress versions prior to 3.54.11 Description Sensitive information exposure occurs via the JSON-LD REST API endpoints. The plugin registers the '/wordlift/v1/jsonld/' routes, specifically...

PT-2026-95770

Name of the Vulnerable Software and Affected Versions Mailchimp for WooCommerce WordPress plugin versions prior to 6.1.1 Description Several REST API routes fail to verify if the requesting user possesses the necessary capabilities within the permission callback. This allows unauthenticated users...

CVE-2026-92435: Missing Authorization

The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state...

CVE-2026-92404: Exposure of Sensitive Information to an Unauthorized Actor

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site...

CVE-2026-88824: Improper Neutralization of Input During Web Page Generation

The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator...

CVE-2026-82885

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to gain elevated privileges due to missing authorization in the REST API...

WordPress WordLift – AI powered SEO – Schema plugin <= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints vulnerability

Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints vulnerability discovered by Benedictus Jovan aillesiM in WordPress Plugin WordLift versions = 3.54.10...

EUVD-2026-83312

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to gain elevated privileges due to missing authorization in the REST API...

CVE-2026-82885

IBM Guardium Data Protection 12.2 is affected by a missing authorization flaw (CWE-862) in the REST API , allowing a remote authenticated attacker to gain elevated privileges. The flaw is scored CVSS 8.8 (High) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning low-privilege remote acc...

CVE-2026-82885 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to gain elevated privileges due to missing authorization in the REST API...