14071 matches found
CVE-2026-86608: Uncontrolled Resource Consumption
The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an...
PT-2026-97174
Name of the Vulnerable Software and Affected Versions The Events Calendar WordPress plugin versions prior to 6.17.5 Description A broken access control issue exists where the software fails to verify the post status of linked records before including their stored details in a public REST API...
PT-2026-97169
Name of the Vulnerable Software and Affected Versions The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions prior to 8.9.5 Description The plugin fails to verify user capabilities when processing order creation via its REST API. This allows users with...
PT-2026-97162
Name of the Vulnerable Software and Affected Versions The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions prior to 8.9.5 Description A REST collection endpoint is not scoped to the requesting user, which allows users with subscriber-level accounts t...
REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182
This module enables you to add an extra authentication layer to the API. The module does not sufficiently validate authentication requirements for all API requests, which can result in an access bypass vulnerability...
PT-2026-97168
Name of the Vulnerable Software and Affected Versions The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions prior to 8.9.5 Description An unrestricted REST endpoint allows unauthenticated attackers to access and read private contact details of...
CVE-2026-84743: Incorrect Authorization
The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including...
Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186
This module enables you to retrieve and submit webforms via REST. The module doesn't sufficiently check permission to webform and webform submission entities when retrieving webform elements or fields...
CVE-2026-86783: Exposure of Sensitive Information to an Unauthorized Actor
The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform an authorization or post-visibility check on a REST API route that returns the custom field keys of a given post, allowing unauthenticated users to disclose the custom field key names of arbitrary posts, including...
PT-2026-97181
Name of the Vulnerable Software and Affected Versions Post Grid Gutenberg Blocks versions prior to 5.0.41 Description An issue exists where the plugin fails to perform authorization or post-visibility checks on a REST API route. This allows unauthenticated users to disclose the custom field key...
CVE-2026-84027: Missing Authorization
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and...
CVE-2026-83805 Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs
Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approver-group membership, change permission on the object under review, or the one-response-per-user restriction applied by th...
CVE-2026-83805
Nautobot versions 3.0.0 through 3.1.8 are vulnerable to an authorization bypass in the approval workflow REST API. The generic ApprovalWorkflowStageResponse create endpoint fails to enforce approver-group membership, object change permissions, or the one-response-per-user restriction. An attacker...
CVE-2026-83805 Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs
Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approver-group membership, change permission on the object under review, or the one-response-per-user restriction applied by th...
CVE-2026-85055 Twenty: Field-level read bypass
Twenty is an open-source CRM customer relationship management platform. Prior to 2.22.0, field-level read permission is enforced on selected output fields but not on GraphQL or REST filter predicates. A workspace member or API key with permission to read an object but not a particular field can...
CVE-2026-85055 Twenty: Field-level read bypass
Twenty is an open-source CRM customer relationship management platform. Prior to 2.22.0, field-level read permission is enforced on selected output fields but not on GraphQL or REST filter predicates. A workspace member or API key with permission to read an object but not a particular field can...
CVE-2026-75791
Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API...
CVE-2026-95665 MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON
MISP contains a reflected cross-site scripting XSS vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP's...