CVE-2026-89334

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.15.33. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CVE-2026-15660

The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handleoauthcallback function which is hooked to admininit and processes $GET'accesstoken' and $GET'googleemail' without verifying t...

CVE-2026-89334 Better Messages <= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/<id>' REST Endpoint

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.15.33. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CVE-2026-88944 Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

CVE-2026-88944

CVE-2026-88944 is an authorization bypass in the Tutor LMS WordPress plugin (all versions up to and including 4.0.8 ). The plugin fails to properly verify that a user is authorized to perform an action, allowing authenticated attackers with subscriber-level access or above to permanently delete a...

CVE-2026-88944 Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

EUVD-2026-83474

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

CVE-2026-89334 Better Messages <= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/<id>' REST Endpoint

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.15.33. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

EUVD-2026-83475

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.15.33. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CVE-2026-89334

The Better Messages plugin for WordPress (chat rooms, group chat, private messages & AI chat bots) is vulnerable to authorization bypass in all versions up to and including 2.15.33 . The plugin fails to properly verify user authorization on the /thread/ REST endpoint , allowing any authenticated ...

CVE-2026-15760 Divi Essentials <= 5.8.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX Action

The Divi Essential plugin for WordPress is vulnerable to sensitive information exposure in versions up to, and including, 5.8.1 via the dnxtegetdatabasetables and dnxtegetdatabasedata AJAX actions. The handlers only conditionally verify a nonce the check runs solely when the 'nonce' POST paramete...

EUVD-2026-83468

The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handleoauthcallback function which is hooked to admininit and processes $GET'accesstoken' and $GET'googleemail' without verifying t...

CVE-2026-15660 SEO Booster <= 7.4.7 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Modification via handle_oauth_callback()

The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handleoauthcallback function which is hooked to admininit and processes $GET'accesstoken' and $GET'googleemail' without verifying t...

CVE-2026-15660 SEO Booster <= 7.4.7 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Modification via handle_oauth_callback()

The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handleoauthcallback function which is hooked to admininit and processes $GET'accesstoken' and $GET'googleemail' without verifying t...

CVE-2026-15660

The SEO Booster WordPress plugin (versions up to 7.4.7 ) is affected by a Missing Authorization vulnerability in the handle_oauth_callback() function, which is hooked to admin_init . The function processes $_GET['access_token'] and $_GET['google_email'] without verifying the caller's role. This a...

SUSE CVE-2026-61709

OpenFGA is an authorization and permission engine built for developers. Prior to 1.18.1, the ListUsers API could return a user that should have been excluded when an authorization relation used an intersection containing a base but not excluded operand, the base was granted through a type-bound...

SUSE CVE-2026-73553

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignorepathparametersinpathmatching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC urlpath matcher evaluates the raw path. ...

CLEANSTART-2026-IG03697 Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours)

Security vulnerability affects the keycloak package. Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies for example, only allowing access during business hours...

CVE-2026-1242: Incorrect Authorization

The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND && operator instead of an OR || operator. This makes it possible for authenticated attackers, with...

CVE-2026-4792: Missing Authorization

The Bread plugin for WordPress is vulnerable to information exposure in versions up to and including 2.9.12. This is due to the lack of authentication and authorization checks on the settings export functionality downloadsettings function which is registered on the pluginsloaded hook and explicit...