📄 WordPress Hippoo 1.9.5 Unauthenticated Admin Account Takeover

WordPress Hippoo plugin version 1.9.5 contains an unauthenticated admin account takeover vulnerability through REST. A remote attacker can take over an administrator account. This proof of concept exploit demonstrates the vulnerable request flow against the affected plugin. !/usr/bin/env python3...

Gitea: REST API exposes organization membership of private organizations to public

The endpoint "/orgs/org/publicmembers/username" + GET exposes organization membership of public members in a private organization...

CVE-2026-44231

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged non-administrative user can obtain authentication credentia...

CVE-2026-44231 RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged non-administrative user can obtain authentication credentia...

CVE-2026-44231 RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged non-administrative user can obtain authentication credentia...

CVE-2026-44231

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged non-administrative user can obtain authentication credentia...

CVE-2026-44231

CVE-2026-44231 affects RT REST 2.0: a privileged (non-administrative) user can obtain authentication credentials belonging to other users (including admins) and use them to read data via RT’s feed endpoints. The same request that exposes credentials also rotates them, invalidating existing feed U...

EUVD-2026-46076

Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privileged authenticated backend user to self-assign the administrative layout and self-grant the CMS Administrator role, then achieve remote co...

Exploit for CVE-2026-63030

CVE-2026-63030 WordPress REST Batch Route-Confusion SQL I...

CVE-2026-63107 LimeSurvey SSRF via REST API Survey Template Host Header

LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use...

EUVD-2026-46061

LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use...

CVE-2026-63107

LimeSurvey (versions up to 6.17.10 and 7.0.4) contains a server-side request forgery in the REST API survey template endpoint. The vulnerability arises from unsanitized use of the HTTP Host header in getTemplateData(), allowing authenticated users to cause the server to issue arbitrary HTTP reque...

CVE-2026-63107 LimeSurvey SSRF via REST API Survey Template Host Header

LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use...

CVE-2026-47276 NULL Pointer Dereference in REST API properties_parse via Malformed user_properties

In nanomq versions 0.24.11 and earlier, a NULL pointer dereference in propertiesparse allows an authenticated attacker to crash the NanoMQ broker by sending a POST request to /api/v4/mqtt/publish with userproperties as a JSON array instead of a JSON object. The crash occurs because strlen is call...

CVE-2026-47276

CVE-2026-47276 affects NanoMQ up to version 0.24.11: a NULL pointer dereference in properties_parse() when processing user_properties, allowing an authenticated attacker to crash the broker by sending a crafted POST to /api/v4/mqtt/publish with user_properties as a JSON array (strlen on a NULL it...

WordPress wp2shell RCE (CVE-2026-63030 + CVE-2026-60137)

Exploits CVE-2026-63030 REST batch route confusion chained with CVE-2026-60137 WPQuery authornotin SQLi on WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1: unauthenticated administrator creation, plugin upload, and command execution. Patched in 6.9.5 and 7.0.2. !/usr/bin/env python3 -- coding: utf-8 --...

org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=3.0.0-m0, <=4.0.6), org.apache.syncope.ext.flowable:syncope-ext-flowable-rest-cxf (>=3.0.0-m0, <=4.0.6) potentially affected by CVE-2026-53405 via org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn (>=3.0.0-m0, <=4.0.6)

org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.6 Source cves: CVE-2026-53405 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPEEXTFLOWABLE-19352472...

org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.1), org.apache.syncope.ext.flowable:syncope-ext-flowable-rest-cxf (>=4.1.0-m0, <=4.1.1) potentially affected by CVE-2026-53405 via org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn (>=4.1.0-m0, <=4.1.1)

org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.1 Source cves: CVE-2026-53405 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPEEXTFLOWABLE-19352472...

org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=4.1.0-m0, <=4.1.1), org.apache.syncope.ext.flowable:syncope-ext-flowable-rest-cxf (>=4.1.0-m0, <=4.1.1) potentially affected by CVE-2026-53421 via org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn (>=4.1.0-m0, <=4.1.1)

org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn MAVEN version =4.1.0-m0, =4.1.0-m0, =4.1.0-m0, =4.1.1 Source cves: CVE-2026-53421 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPEEXTFLOWABLE-19352511...

org.apache.syncope.ext.flowable:syncope-ext-flowable-logic (>=3.0.0-m0, <=4.0.6), org.apache.syncope.ext.flowable:syncope-ext-flowable-rest-cxf (>=3.0.0-m0, <=4.0.6) potentially affected by CVE-2026-53421 via org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn (>=3.0.0-m0, <=4.0.6)

org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn MAVEN version =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =4.0.6 Source cves: CVE-2026-53421 Source advisory: SNYK:JAVA-ORGAPACHESYNCOPEEXTFLOWABLE-19352511...