CVE-2026-19632

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract t...

CVE-2026-19632 TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract t...

CVE-2026-19632 TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract t...

EUVD-2026-66230

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract t...

CVE-2026-19632

The TranslatePress – Translate Multilingual sites with AI Translation WordPress plugin (versions ≤ 3.3.1 ) is vulnerable to Sensitive Information Exposure via the trp_get_translations_regular AJAX action. This flaw allows unauthenticated attackers to extract raw administrator password-reset URLs ...

CVE-2026-66152

creationtimestamp| type| source ---|---|--- 2026-08-26 01:42:39+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mtx7et2zyz2q 2026-08-26 12:30:20+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtydkyf5re2o 2026-09-24 22:45:52+00:00| seen|...

EUVD-2026-66167

A Broken access control vulnerability in the API user endpoint in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows unprivileged, authenticated users to enable or disable arbitrary user accounts via the req=disable or req=enable action using a normal user-created...

PT-2026-81945

Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar versions 9.0 through 9.7 Description An Insecure Direct Object Reference IDOR exists due to missing validation on a user-controlled key. This allows an authenticated attacker with Provider-level...

PT-2026-82333

Name of the Vulnerable Software and Affected Versions KubePi versions prior to 2.0.0 Description SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, allowing SSO, OIDC, and SAML management operations to be accessed without...

CVE-2026-65956: Missing Authentication for Critical Function

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, so SSO, OIDC, and SAML management operations can be reached without...

CVE-2026-81036: URL Redirection to Untrusted Site

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that...

CVE-2026-74928: Missing Authorization

The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting...

CVE-2026-80348: Missing Authorization

TarsWeb enforces its per-application roles by calling AuthService from individual controller methods, and four methods in app/controller/patch/PatchController.js make no such call. uploadAndPublish accepts a package upload and then builds and dispatches a deployment task to every server matching...

CVE-2026-15985: Authentication Bypass by Alternate Name

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the processotplogin function. This makes it possible for unauthenticated...

CVE-2026-59683: External Control of File Name or Path

The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths extension of CVE-2026-59682. This allows either a full system compromise from local or remote if the daemon is running as root or a full account takeover if the daemon is running in user...

CVE-2026-43621: Incorrect Authorization

Simple Machines Forum SMF through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit th...

CVE-2026-14212: Authorization Bypass Through User-Controlled Key

The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee provider owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their...

CVE-2026-63179: Improper Limitation of a Pathname to a Restricted Directory

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, authenticated backend users can disclose arbitrary files readable by the PHP process by injecting @import inline directives into LESS source that the backend compiles, because the...

CVE-2026-19632: Weak Password Recovery Mechanism for Forgotten Password

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract t...

PT-2026-81958

The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting...