EUVD-2026-74801

Missing Authorization, Improper Control of Generation of Code 'Code Injection', Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Nutch Server Nutch REST API. This issue affects Apache...

CVE-2026-86777

AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal...

EUVD-2026-74789

AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal...

CVE-2026-86777

AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to enforce authorization on the GET /api/nodes endpoint. This allows unauthenticated attackers to retrieve all navigation nodes, disclosing restricted page names, URL paths, and internal URLs across all sites and languages. The vulnerabi...

CVE-2026-86777 AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes

AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal...

CVE-2026-86777 AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes

AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve all navigation nodes. Attackers can access the endpoint without authentication to disclose restricted page names, URL paths, and internal...

BIT-KIBANA-2026-78596 Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations

Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization CWE-862 in Kibana can lead to unauthorized modification of data via Privilege Abuse CAPEC-122. An authenticated user holding Security read-level access in a single Kibana space could trigger Entit...

BIT-KIBANA-2026-78595 Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure

Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization CWE-862 in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse CAPEC-122. An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent...

BIT-ELK-2026-78596 Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations

Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization CWE-862 in Kibana can lead to unauthorized modification of data via Privilege Abuse CAPEC-122. An authenticated user holding Security read-level access in a single Kibana space could trigger Entit...

BIT-ELK-2026-78595 Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure

Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization CWE-862 in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse CAPEC-122. An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent...

CVE-2026-15398 Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.22. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CVE-2026-15398

The Eventin WordPress plugin (Event Calendar, Event Registration, Tickets & Booking, AI Powered) is vulnerable to an authorization bypass in all versions up to and including 4.1.22 . The root cause is improper authorization verification in the OrderController , where the wp_rest nonce is publicly...

CVE-2026-19802

The Checkout Custom Fields Builder for WooCommerce WordPress plugin (versions ≤ 1.1.5) is vulnerable to authorization bypass , discovered by Nabil Irawan. The plugin fails to properly verify that a user is authorized before allowing plugin installation. Critically, the required nonce is emitted i...

CVE-2026-84908

The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnlloadpayment' AJAX action for both authenticated and unauthenticated wpajaxnopriv users and the underlying addofferproducttocart...

CVE-2026-81021

The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers...

CVE-2026-19946

The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpasdomrdenyuser function, which unlike its counterpart wpasdomractivateuser does not enforce currentusercan'editusers' or...

CVE-2026-85133 WPLP Cookie Consent < 4.4.2 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent...

WordPress WPLP Cookie Consent plugin < 4.4.2 - Subscriber+ Missing Authorization vulnerability

Subscriber+ Missing Authorization vulnerability discovered by Naoki Kawahigashi in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.4.2...

CVE-2026-85133 WPLP Cookie Consent < 4.4.2 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent...

CVE-2026-85133

The WPLP Cookie Consent WordPress plugin before 4.4.2 fails to perform nonce or capability checks on several settings AJAX actions. This allows any authenticated user with Subscriber-level access to read and destroy scan data belonging to the administrator and to overwrite the plugin's stored con...