CVE-2026-74927

The MultiVendorX WordPress plugin (versions 5.0.13-5.0.14 ) is vulnerable to an unauthenticated information disclosure due to insufficient authorization controls on a REST API listing route. An attacker can exploit this flaw to retrieve sensitive data, including vendor contact and payout details ...

CVE-2026-74927 MultiVendorX 5.0.13 - 5.0.14 - Unauthenticated Vendor PII and Payout Data Disclosure via stores REST Endpoint

The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications...

CVE-2026-74927 MultiVendorX 5.0.13 - 5.0.14 - Unauthenticated Vendor PII and Payout Data Disclosure via stores REST Endpoint

The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications...

WordPress MultiVendorX plugin 5.0.13-5.0.14 - Unauthenticated Vendor PII and Payout Data Disclosure vulnerability

Unauthenticated Vendor PII and Payout Data Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin MultiVendorX versions 5.0.13-5.0.14...

CVE-2026-81200

The MasterStudy LMS WordPress plugin (versions before 3.7.42 ) contains an IDOR (Insecure Direct Object Reference) vulnerability. Due to insufficient access control, any user assigned the instructor role can access and read other users' order billing details—including names, email addresses, phon...

CVE-2026-81200 MasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure vulnerability

Instructor+ Cross-Tenant Order Billing PII Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin MasterStudy LMS versions 3.7.42...

CVE-2026-81200 MasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...

[SECURITY] Fedora 44 Update: postgresql16-anonymizer-3.1.3-1.fc44

PostgreSQL Anonymizer is an extension to mask or replace personally identifiable information PII or commercially sensitive data from a PostgreSQL database. The project has a declarative approach of anonymization. This means you can declare the masking rules using the PostgreSQL Data Definition...

WordPress Salon booking system plugin <= 10.31.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Salon booking system versions = 10.31.1...

WordPress Simple Newsletter Plugin plugin < 4.3.3 - Unauthenticated Subscriber PII and confirm_key Disclosure vulnerability

Unauthenticated Subscriber PII and confirmkey Disclosure vulnerability discovered by Shivamani Vastrala in WordPress Plugin Noptin versions 4.3.3...

CVE-2026-78146 Noptin < 4.3.3 - Unauthenticated Subscriber PII and confirm_key Disclosure via Actions Page

The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering that subscriber's stored details, allowing unauthenticated users to disclose a subscriber's personal data along with the key that authorises...

CVE-2026-78146

The Simple Newsletter Plugin for WordPress (versions before 4.3.3 ) is vulnerable to an information disclosure flaw. The plugin fails to verify the identity of a requester against the subscriber named in a public request before rendering stored details. This allows unauthenticated users to access...

CVE-2026-78146 Noptin < 4.3.3 - Unauthenticated Subscriber PII and confirm_key Disclosure via Actions Page

The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering that subscriber's stored details, allowing unauthenticated users to disclose a subscriber's personal data along with the key that authorises...

WordPress MStore API plugin < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR vulnerability

Subscriber+ Order and Customer PII Disclosure via IDOR vulnerability discovered by Sai Praneeth Koti in WordPress Plugin MStore API versions 4.21.0...

BIT-KEYCLOAK-2026-37981 Keycloak: org.keycloak.authorization: keycloak: information disclosure via broken access control in user lookup endpoint

A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote authenticated user, who owns at least one User-Managed Access UMA resource, to enumerate and harvest personally identifiable information PII for all realm users. By...

BIT-KEYCLOAK-2026-37978 Keycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin api

A flaw was found in Keycloak. A low-privilege administrator with the 'view-clients' role can exploit this by invoking the 'evaluate-scopes' Admin API endpoints with an arbitrary user ID userId parameter. This vulnerability allows for cross-role personally identifiable information PII leakage,...

Malicious code in spf-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dece44c5ce884af66714dbff1f022e0345e860d0090cb7bcb30fd7b352cdd77 index.js is a heavily obfuscated browser script obfuscator.io-style string-array + rotation advertised for inclusion via unpkg on Shopify-style...

MAL-2026-14486 Malicious code in spf-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dece44c5ce884af66714dbff1f022e0345e860d0090cb7bcb30fd7b352cdd77 index.js is a heavily obfuscated browser script obfuscator.io-style string-array + rotation advertised for inclusion via unpkg on Shopify-style...

Malicious code in vite-plugin-images-analysis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36ac1f55db3f6447b28ded9ee9c6b792487d225e52fe5ec393f75887001a5388 This Vite plugin, advertised as an image-analysis tool, uses transformIndexHtml to inject an inline script into every built HTML page produced by the...