CVE-2026-85574

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from...

WordPress Mailchimp for WooCommerce plugin < 6.1.1 - Unauthenticated Broken Access Control in REST API vulnerability

Unauthenticated Broken Access Control in REST API vulnerability discovered by Pablo González and Francisco José Ramírez in WordPress Plugin MailChimp For WooCommerce versions 6.1.1...

CVE-2026-92435 Mailchimp for WooCommerce < 6.1.1 - Unauthenticated Broken Access Control in REST API

The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state...

EUVD-2026-83517

The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state...

CVE-2026-92435 Mailchimp for WooCommerce < 6.1.1 - Unauthenticated Broken Access Control in REST API

The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state...

EUVD-2026-83509

The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing any unauthenticated visitor to read another visitor's assistant messages and ...

SUSE CVE-2026-46519

mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to version 3.6.0, mcp-server-kubernetes exposes three environment variables ALLOWONLYREADONLYTOOLS, ALLOWONLYNONDESTRUCTIVETOOLS, ALLOWEDTOOLS documented as access controls for restricting which...

SUSE CVE-2026-89058

A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins "", reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to...

EUVD-2026-83457

SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metadata. Attackers can call the endpoint with type=8 and crafted content to read block titles, names, aliases, and hierarchical paths of...

CVE-2026-92099: Improper Access Control

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own...

CVE-2026-93921

SiYuan (a self-hosted note-taking application) versions through 3.8.4 contain an access control bypass in the getDynamicIcon endpoint. The endpoint fails to enforce publish access control, allowing holders of read-only tokens to call it with type=8 and crafted content to extract block titles, nam...

CVE-2026-93921 SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint

SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metadata. Attackers can call the endpoint with type=8 and crafted content to read block titles, names, aliases, and hierarchical paths of...

CVE-2026-93921 SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint

SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metadata. Attackers can call the endpoint with type=8 and crafted content to read block titles, names, aliases, and hierarchical paths of...

CVE-2026-93921 SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint

SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metadata. Attackers can call the endpoint with type=8 and crafted content to read block titles, names, aliases, and hierarchical paths of...

CVE-2026-63647

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilters permits the SSE paths, and the...

CVE-2026-93852

In OpenStack Blazar before 17.0.1, the V2 lease listing operation GET /v2/leases returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate leases belonging to other tenants, exposing...

CVE-2026-93852

OpenStack Blazar before 17.0.1 has a broken authorization flaw in the V2 lease listing endpoint (GET /v2/leases). The endpoint returns leases for every project without enforcing project scoping or an administrator-only policy, allowing any authenticated user with REST API access to enumerate leas...

CVE-2026-81182

SysReptor , a customizable pentest reporting platform, contains a broken access control vulnerability in its writable shared notes feature. Prior to version 2026.68 , an unauthenticated attacker holding a public read-write note share link can disclose an uploaded file or image from the same proje...

CVE-2026-81182 SysReptor: Unauthorized file disclosure by broken access control in writable shared notes

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a public read-write note share link can disclose an uploaded file or image from the same project by updating the shared note to reference the target asset filename. The...

CVE-2026-81182 SysReptor: Unauthorized file disclosure by broken access control in writable shared notes

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a public read-write note share link can disclose an uploaded file or image from the same project by updating the shared note to reference the target asset filename. The...