CVE-2026-77767 Reconmap Report Preview Endpoint Is Marked AllowAnonymous, Exposing Every Project and Client Organisation Without Authentication

Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user holding the administrator role, so controllers without their own attribute reject anonymous callers. The report preview action in apps/api/app/Controllers/ReportsController.cs...

CVE-2026-77767 Reconmap Report Preview Endpoint Is Marked AllowAnonymous, Exposing Every Project and Client Organisation Without Authentication

Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user holding the administrator role, so controllers without their own attribute reject anonymous callers. The report preview action in apps/api/app/Controllers/ReportsController.cs...

WordPress SmartCrawl plugin < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration vulnerability

Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration vulnerability discovered by Ezekiel Victor in WordPress Plugin SmartCrawl versions 3.16.3...

PT-2026-79305

The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs, changing a WooCommerce order's status based solely on an attacker-supplied numeric order id, so an unauthenticated attacker can cancel or...

CVE-2026-27462: Observable Response Discrepancy

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has been fixed in version 3.2.3...

CVE-2026-16962: Missing Authorization

The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs, changing a WooCommerce order's status based solely on an attacker-supplied numeric order id, so an unauthenticated attacker can cancel or...

PT-2026-79441

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has been fixed in version 3.2.3...

CVE-2026-54509

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...

CVE-2026-66002

Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-data web form and PersonalDataDownloadRequest class in frappe/website/doctype/personaldatadownloadrequest/personaldatadownloadrequest.py return distinguishable response shapes for registered and...

CVE-2026-53569

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted togglelike and markasseen endpoints in frappe/desk/like.py and frappe/desk/doctype/note/note.py do not enforce read permission before modifying likedby metadata or a Note seen state. An authenticated...

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

Summary userpassword.Compare substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash nonexistent users and SSO-only users and a subsequent login-type check returned an HTTP 40...

GHSA-8FXQ-53RX-PH5F Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

Summary userpassword.Compare substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash nonexistent users and SSO-only users and a subsequent login-type check returned an HTTP 40...

CVE-2026-66002 Frappe: User Enumeration via PDDR

Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-data web form and PersonalDataDownloadRequest class in frappe/website/doctype/personaldatadownloadrequest/personaldatadownloadrequest.py return distinguishable response shapes for registered and...

CVE-2026-66002

Frappe , a full-stack web application framework, is vulnerable to user enumeration via its public request-data web form and PersonalDataDownloadRequest class. The endpoint returns distinguishable response shapes for registered versus unregistered email addresses, including the user_name field and...

EUVD-2026-63541

Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-data web form and PersonalDataDownloadRequest class in frappe/website/doctype/personaldatadownloadrequest/personaldatadownloadrequest.py return distinguishable response shapes for registered and...

CVE-2026-66002 Frappe: User Enumeration via PDDR

Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-data web form and PersonalDataDownloadRequest class in frappe/website/doctype/personaldatadownloadrequest/personaldatadownloadrequest.py return distinguishable response shapes for registered and...

CVE-2026-53569 Frappe: Missing authorization in toggle_like and mark_as_seen

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted togglelike and markasseen endpoints in frappe/desk/like.py and frappe/desk/doctype/note/note.py do not enforce read permission before modifying likedby metadata or a Note seen state. An authenticated...

CVE-2026-76634 WeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.php

WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an idpessoa parameter through a request extraction function that overwrites the session-derived...

CVE-2026-76634

WeGIA before 3.9.2 is affected by an Insecure Direct Object Reference (IDOR) vulnerability in the employee profile page (profile_funcionario.php). The root cause is a request extraction function that allows an attacker-supplied id_pessoa parameter to overwrite the session-derived identifier, enab...

EUVD-2026-63255

The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.geturl, rssParserConfig with no address validation. The same file guards the subscribe path with validateUrl, which rejects private and reserved ranges through the private-i...