CVE-2025-14484 Image Buzz <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary API Key Modification via 'pixabay_api' Parameter

The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys Pixabay, Unsplash, Pixels configured by site...

Security Bulletin: Vulnerabilities in Apache Tomcat Server library (CVE-2026-59083, CVE-2026-55956) affect Power HMC.

Summary The Apache Tomcat Server library is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-59083 DESCRIPTION: Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security...

SUSE-SU-2026:23869-1 Security update for rabbitmq-server

This update for rabbitmq-server fixes the following issues: - CVE-2026-44839: XSS in management UI due to unsanitized vhost names bsc1266465. - CVE-2026-57212: The rabbitmqmanagement HTTP API accepts oversized valid JSON bodies on withdecode and directrequest paths bsc1271318. - CVE-2026-57213:...

EUVD-2026-84206

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows authenticated users to read any other user's full profile. Attackers can iterate the userId parameter to harvest sensitive user information including mobile numbers, email addresse...

EUVD-2026-84210

lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing authenticated users to read any employee's roles and permissions. Attackers can supply arbitrary employeeId values to enumerate other employees' role codes, permission codes, an...

EUVD-2026-84207

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachments. Attackers can retrieve other users' stored files by supplying valid attachment identifiers to the /anyone/file/down and...

EUVD-2026-84209

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users' notifications. Attackers can call the DELETE /anyone/extendNotice/deleteMyNotice endpoint with arbitrary notice IDs to permanently remove...

PT-2026-97083

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Improper authentication and missing authorization may allow a remote attacker to perform unauthorized actions. Recommendations At the moment...

PT-2026-96726

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description An authenticated user can bypass sharing-group authorization checks by sending a PUT request instead of a POST request to the 'collections/add' endpoint. This occurs because the add method in th...

PT-2026-96924

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description An authorization bypass exists where the ENABLED TOOLS and TOOLSETS filters are only enforced during the tools/list request and are not re-verified when a tools/call request is dispatched. Thi...

PT-2026-96657

Name of the Vulnerable Software and Affected Versions PixelPlay versions prior to 1.0.3 Description The PixelPlay plugin for WordPress contains a flaw where authorization checks are missing, allowing unauthenticated attackers to delete API keys configured by site administrators. This is achieved ...

PT-2026-96665

Name of the Vulnerable Software and Affected Versions WP Table Builder – Drag & Drop Table Builder versions prior to 2.2.2 Description Incorrect Authorization exists due to an operator precedence bug in the post-type guard within the trash table bulk and restore table bulk functions, which preven...

PT-2026-96733

Name of the Vulnerable Software and Affected Versions MarketKing plugin for WordPress versions prior to 2.1.72 Description An authorization flaw exists in the marketking duplicate product AJAX action. Authenticated users with subscriber-level access or higher can duplicate any vendor's product by...

PT-2026-96898

Name of the Vulnerable Software and Affected Versions Adobe Campaign Classic ACC affected versions not specified Description An Incorrect Authorization issue allows an attacker to execute arbitrary code in the context of the current user. This flaw does not require user interaction to be exploite...

CVE-2026-95685: Missing Authorization

MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of suggestion content within an event report, was incorrectly mapped to the wildcard permission '' in the ACLComponent, making it accessible to any authenticated...

CVE-2026-95671: Missing Authorization

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

CVE-2026-95697: Missing Authorization

MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group SG edit...

CVE-2026-95683: Missing Authorization

In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constraints. Because MISP reports carry an...

CVE-2026-93344: Missing Authorization

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketkinggetpagecontent AJAX action that allows authenticated attackers with subscriber-level access or higher to access arbitrary vendor administrator panel pages by supplying an arbitrary vendor...

CVE-2026-6922: Incorrect Authorization

The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.2.1. This is due to an operator precedence bug in the post-type guard within the trashtablebulk and restoretablebulk functions that causes the gua...