CVE-2026-41869 Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)

Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server Nutch REST API. This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, use...

CVE-2026-41869 Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)

Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server Nutch REST API. This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, use...

CVE-2026-41870 Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)

Missing Authorization, Improper Control of Generation of Code 'Code Injection', Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Nutch Server Nutch REST API. This issue affects Apache...

EUVD-2026-74801

Missing Authorization, Improper Control of Generation of Code 'Code Injection', Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Nutch Server Nutch REST API. This issue affects Apache...

CVE-2026-41870

The Apache Nutch Server (Nutch REST API) is vulnerable to unauthenticated remote code execution (RCE) via JEXL injection . This flaw is caused by missing authorization, improper control of code generation, and unsafe reflection when handling externally controlled input. The issue impacts Apache N...

EUVD-2026-74773

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the authenticate method — registered on the restauthenticationerrors filter and therefore evaluated for every unauthenticated REST API...

CVE-2026-80099

CVE-2026-80099 affects several Newfold WordPress plugins (Crazy Domains, Web, Hostgator, Bluehost) that bundle the wp-module-data module. The root cause is an HMAC-style Bearer token validation flaw : when HiiveConnection::get_auth_token() returns false, PHP coerces strrev(false) to an empty stri...

WordPress Next-Cart Store to WooCommerce Migration plugin <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint vulnerability

Unauthenticated Authentication Bypass via Default 'token' Fallback in REST Migration Endpoint vulnerability discovered by Samuele Santonicola in WordPress Plugin Next-Cart Store to WooCommerce Migration versions = 3.9.8...

CVE-2026-82848

The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowing unauthenticated users to read any learner's enrolment status, timestamps and course-progress data by walking sequential record identifier...

CVE-2026-82848 Masteriyo LMS 1.3.1 - 2.3.3 - Unauthenticated Course Enrollment Disclosure

The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowing unauthenticated users to read any learner's enrolment status, timestamps and course-progress data by walking sequential record identifier...

CVE-2026-82848

The Masteriyo LMS WordPress plugin (versions before 3.4.0 ) is vulnerable to an unauthenticated course enrollment disclosure due to a missing authorization check on its REST API . An attacker can walk sequential record identifiers to read sensitive data, including learner enrolment status , times...

EUVD-2026-74712

The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowing unauthenticated users to read any learner's enrolment status, timestamps and course-progress data by walking sequential record identifier...

CVE-2026-82848 Masteriyo LMS 1.3.1 - 2.3.3 - Unauthenticated Course Enrollment Disclosure

The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowing unauthenticated users to read any learner's enrolment status, timestamps and course-progress data by walking sequential record identifier...

CVE-2026-76009 Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint

The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the NCWMKitconnect::run function. This is due to the plugin registering the /wp-json/nextcart/v1/migration REST route with permissioncallback se...

CVE-2026-76009

The Next-Cart Store to WooCommerce Migration WordPress plugin (versions ≤ 3.9.8) is vulnerable to unauthenticated authentication bypass via the NCWM_Kitconnect::run() function. The REST route /wp-json/next_cart/v1/migration is registered with permission_callback set to __return_true and relies on...

CVE-2026-76009 Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint

The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the NCWMKitconnect::run function. This is due to the plugin registering the /wp-json/nextcart/v1/migration REST route with permissioncallback se...

EUVD-2026-74689

The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the NCWMKitconnect::run function. This is due to the plugin registering the /wp-json/nextcart/v1/migration REST route with permissioncallback se...

CVE-2026-11821

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) WordPress plugin is vulnerable to authorization bypass in all versions up to and including 4.1.17 . The root cause is a missing authorization check on the notification-flow REST API endpoint , allowing authenticated ...

CVE-2026-11821 Eventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CVE-2026-11821 Eventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...