CVE-2026-52744

The GoCD continuous delivery server versions 20.2.0 through 26.1.0 is vulnerable to an authorization bypass in the internal UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines/**/upstream. Due to inadequate authorization of upstream dependency data, an authenticated user can retri...

CVE-2026-52744 GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines//upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy...

CVE-2026-86867 Cinnamon's kotaemon contains improper authorization checks in multi‑user chat handlers

Cinnamon's Kotaemon all versions up to and including v0.12.0 multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and improper access controls. There are four handler methods in libs/ktem/ktem/pages/chat/control.py that load a Conversation record by its ID...

CVE-2026-86867 Cinnamon's kotaemon contains improper authorization checks in multi‑user chat handlers

Cinnamon's Kotaemon all versions up to and including v0.12.0 multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and improper access controls. There are four handler methods in libs/ktem/ktem/pages/chat/control.py that load a Conversation record by its ID...

CVE-2026-96655

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...

DRUPAL-CONTRIB-2026-184

This module provides integration of the tawk.to live chat for Drupal sites. The module does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery CSRF vulnerability...

DRUPAL-CONTRIB-2026-165

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. When Webform is used with JSON:API enabled, submissions may be cached without varying correctly by the authenticated user. If a webform is configured so that...

CVE-2026-96655 Plex Media Server arbitrary-host SSRF

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...

CVE-2026-96655 Plex Media Server arbitrary-host SSRF

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...

EUVD-2026-85369

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...

USN-8805-1 moodle vulnerability

It was discovered that Moodle did not properly restrict URLs. An authenticated user could possibly use this issue to perform a server-side request forgery attack and expose sensitive information...

GHSA-RR49-F9G6-C9R5 plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection

Impact The Classic portlet plone.app.portlets.portlets.classic used its user-supplied template/macro fields to build a TALES path expression that was then evaluated by the TAL path helper. Because the value was interpreted as a full TALES expression, a user able to add or edit a Classic portlet...

CVE-2026-86602

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes...

CVE-2026-91073 Subscribe Forms 1.4.1 - 1.6.2 - Author+ Stored XSS via Attention Effect Form Setting

The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who views a...

EUVD-2026-84953

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser due to improper neutralization of HTML input...

CVE-2026-93510: Missing Authorization

The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty...

CVE-2026-86602: Exposure of Sensitive Information to an Unauthorized Actor

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes...

CVE-2026-96655: Server-Side Request Forgery (SSRF)

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...

CVE-2026-71461: Generation of Error Message Containing Sensitive Information

HostList.list catches bare Exception and returns stre verbatim. Via hostfilter, any authenticated user triggers Django FieldError leaking complete Host model relation graph including internal reverse accessors or PostgreSQL DataError leaking raw database error strings. Two primitives:...

CVE-2026-71459: Missing Authorization

JobJobEventsChildrenSummary view has no model/parentmodel. ModelAccessPermission.checkgetpermissions falls through returns True for any authenticated user. The view uses raw getobjector404Job, pk without DRF object-level permission check. Zero-privilege user reads event tree structure,...