CVE-2026-56681

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header in src/dashboardGuard.js when isLocalRequest decides whether canAccessPublicLlmApi may skip...

EUVD-2026-84547

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The...

CVE-2026-94455 Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The...

CVE-2026-94455 Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The...

CVE-2026-94455 Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The...

CVE-2026-94455

The postiz-app software is vulnerable to a critical authentication bypass due to the enterprise controller being omitted from the authentication middleware's explicit controller list. An unauthenticated attacker can access the provisioning endpoint for enterprise and reseller organisations by pro...

CVE-2026-56681 9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header in src/dashboardGuard.js when isLocalRequest decides whether canAccessPublicLlmApi may skip...

CVE-2025-14486

The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to delete arbitrary API keys Pixabay, Unsplash, Pixels, OpenAI configured by site...

CVE-2025-14484

The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys Pixabay, Unsplash, Pixels configured by site...

CVE-2025-14484

The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification in all versions up to and including 1.0.3 . The root cause is missing authorization checks , which allows unauthenticated attackers to modify arbitrary API keys for Pixabay , Unsplash , and Pixels . Attackers c...

CVE-2025-14484 Image Buzz <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary API Key Modification via 'pixabay_api' Parameter

The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys Pixabay, Unsplash, Pixels configured by site...

CVE-2025-14484 Image Buzz <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary API Key Modification via 'pixabay_api' Parameter

The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys Pixabay, Unsplash, Pixels configured by site...

CVE-2025-14486 PixelPlay <= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary API Key Deletion via 'clear_api_type' Parameter

The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to delete arbitrary API keys Pixabay, Unsplash, Pixels, OpenAI configured by site...

CVE-2025-14486 PixelPlay <= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary API Key Deletion via 'clear_api_type' Parameter

The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to delete arbitrary API keys Pixabay, Unsplash, Pixels, OpenAI configured by site...

CVE-2025-14486

The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion in all versions up to and including 1.0.2 . The root cause is missing authorization checks , which allow unauthenticated attackers to delete arbitrary API keys (including Pixabay , Unsplash , Pixels , and OpenAI ) c...

CVE-2026-56681: Reliance on Untrusted Inputs in a Security Decision

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header in src/dashboardGuard.js when isLocalRequest decides whether canAccessPublicLlmApi may skip...

CVE-2026-94455: Missing Authentication for Critical Function

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The...

CVE-2025-14484: Missing Authorization

The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys Pixabay, Unsplash, Pixels configured by site...

PT-2026-96820

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.5.6 Description Deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header. In src/dashboardGuard.js, the isLocalRequest function...

CVE-2025-14486: Missing Authorization

The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to delete arbitrary API keys Pixabay, Unsplash, Pixels, OpenAI configured by site...