CVE-2026-92435: Missing Authorization

The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state...

PT-2026-95875

Name of the Vulnerable Software and Affected Versions Argo Workflows versions 4.1.0 through 4.1.3 Description An authorization bypass exists in the ListArchivedWorkflows function. The issue occurs when the metadata.namespace field selector utilizes the NotEquals operator, causing a failure to app...

CVE-2026-94001: Missing Authorization

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from...

CVE-2026-15946: Missing Authorization

The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.23. This is due to the plugin not properly verifying that a user is authorized to perform an...

PT-2026-95796

Name of the Vulnerable Software and Affected Versions Flex Import versions prior to 3.1 Description The plugin contains a missing authorization flaw. The license activate fleximp and license deactivate fleximp functions, which are linked to the wp ajax license activate fleximp and wp ajax license...

PT-2026-95760

Name of the Vulnerable Software and Affected Versions Master Blocks versions prior to 1.5.0 Description An authorization flaw exists in a REST route that allows unauthenticated users to update plugin settings. This includes the ability to modify a value that is output unescaped in the...

CVE-2026-88944: Missing Authorization

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

Linux Distros Unpatched Vulnerability : CVE-2026-61821

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, droppartitionid and droppartitiontime use...

PT-2026-95774

Name of the Vulnerable Software and Affected Versions BlockSpare versions prior to 4.2.7 Description The BlockSpare plugin for WordPress contains an authorization bypass flaw caused by incorrect logic within the permission callback. The issue stems from the use of an AND && operator instead of an...

PT-2026-95845

The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official clie...

PT-2026-95801

Name of the Vulnerable Software and Affected Versions TikTok plugin for WordPress versions prior to 1.4.2 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows unauthenticated attackers to overwrite...

CVE-2026-18346: Missing Authorization

The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the merchant's stor...

PT-2026-95870

Name of the Vulnerable Software and Affected Versions grimmory-tools grimmory versions 3.3.3 and earlier grimmory-tools grimmory versions 3.4.1 and earlier Description An authorization bypass exists in the Download Endpoint component. A remote attacker can manipulate the bookId argument within th...

PT-2026-95781

Name of the Vulnerable Software and Affected Versions Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization versions prior to 2.6.24 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform...

PT-2026-95807

Name of the Vulnerable Software and Affected Versions Datalogics Ecommerce Delivery – Datalogics plugin for WordPress versions prior to 2.6.66 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated...

PT-2026-95800

Name of the Vulnerable Software and Affected Versions YS LeadGen versions prior to 2.1.5 Description An authorization bypass and Stored Cross-Site Scripting XSS issue exists due to missing capability checks on popup management actions. Authenticated users with Subscriber-level access or higher ca...

PT-2026-95751

Name of the Vulnerable Software and Affected Versions Nimble Page Builder WordPress plugin versions prior to 3.3.9 Description An authorization check is missing when returning page-builder content through an authenticated AJAX action. This allows any authenticated user with Subscriber level...

PT-2026-95740

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.9 Description The Tutor LMS plugin for WordPress contains an authorization bypass that allows authenticated users with subscriber-level access or higher to permanently delete arbitrary WordPress posts, such as...

CVE-2026-93921: Missing Authorization

SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metadata. Attackers can call the endpoint with type=8 and crafted content to read block titles, names, aliases, and hierarchical paths of...

CVE-2026-9766: Missing Authorization

The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...