CVE-2026-12949

The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpmregister function validating the registration cookie only against the GET reg parameter while accepting the...

CVE-2026-18039

The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom...

CVE-2026-12949 Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter

The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpmregister function validating the registration cookie only against the GET reg parameter while accepting the...

CVE-2026-12949

The CVE concerns the Wishlist Member plugin for WordPress, affected in versions up to 3.34.1. The vulnerability arises in wpm_register() where the registration cookie is only validated against the GET reg parameter while POST mergewith and POST wpm_id are accepted without verifying that the refer...

CVE-2026-12949

The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpmregister function validating the registration cookie only against the GET reg parameter while accepting the...

CVE-2026-12949 Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter

The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpmregister function validating the registration cookie only against the GET reg parameter while accepting the...

EUVD-2026-58589

The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpmregister function validating the registration cookie only against the GET reg parameter while accepting the...

EUVD-2026-58500

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind...

EUVD-2026-58505

Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner changeTenantOwnerEmail endpoint. On self-hosted instances SELFHOSTED or DISABLEACCOUNTPORTAL set, the cloudRestricted middleware is a no-op and the route is protected only by a...

PT-2026-71963

The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpm register function validating the registration cookie only against the GET reg parameter while accepting the...

CVE-2026-72822: Missing Authentication for Critical Function

The getgrav/grav-plugin-api Composer package before 1.0.13 affected = 1.0.12 fails to enforce API key scope caps on the disable2fa endpoint. Unlike the sibling generate2fa endpoint, disable2fa authorizes the admin non-self path solely via ACL reads isSuperAdmin/hasPermission and never invokes...

PT-2026-72005

Name of the Vulnerable Software and Affected Versions FileBrowser versions prior to 2.63.19 Description An issue exists when the software is hosted on a case-insensitive filesystem, such as Windows/NTFS, and both Signup and CreateUserDir are enabled. The system fails to account for...

PT-2026-72122

Name of the Vulnerable Software and Affected Versions Laravel Socialite affected versions not specified Description The Facebook provider contains an authentication bypass that allows unauthenticated attackers to replay captured OIDC id tokens. This occurs due to missing nonce claim validation in...

PT-2026-71968

The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom...

CVE-2026-18039: Improper Privilege Management

The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration fields from overwriting reserved account attributes, allowing unauthenticated attackers to register an account with an arbitrary role, including administrator, on sites where a custom...

PT-2026-72055

Name of the Vulnerable Software and Affected Versions Tenable Security Center affected versions not specified Description A remote code execution issue exists in the report generation functionality. An authenticated, non-administrative user can exploit this by providing specially crafted input th...

PT-2026-71991

Name of the Vulnerable Software and Affected Versions getgrav/grav-plugin-api versions prior to 1.0.13 Description The software fails to enforce API key scope caps on the disable2fa endpoint. While the generate2fa endpoint correctly applies these caps, disable2fa authorizes the admin path using...

PT-2026-75911

The OAuth callback handler links incoming OAuth identities Google, GitHub, etc. to existing accounts matched by email address without verifying that the existing account's email was verified by its original owner. An attacker who pre-registers with a victim's email address without verifying it...

PT-2026-71995

Name of the Vulnerable Software and Affected Versions getgrav/grav-plugin-api versions prior to 1.0.13 Description The getgrav/grav-plugin-api plugin fails to validate that the scopes of a newly created API key are a subset of the caller's scopes within the createApiKey function. The self-target...

PT-2026-72074

Name of the Vulnerable Software and Affected Versions Emlog versions prior to 2.6.27 Description The install.php endpoint allows the action parameter to be set to reinstall without authentication. This bypasses the installation check because the security guard only executes when the $act variable...