WordPress New User Approve plugin 3.1.0-3.2.9 - Unauthenticated PII Disclosure vulnerability

Unauthenticated PII Disclosure vulnerability discovered by Suhayb Ahmed cyboltx in WordPress Plugin New User Approve versions 3.1.0-3.2.9...

Tokenized Key-Gated Adapter Routing: A Secure Access Control Mechanism against Private Data Leakage in LLMs

Large language models LLMs are increasingly deployed in privacy-critical domains e.g., healthcare, finance, and government, but their propensity to memorize and disclose personally identifiable information PII poses serious security and compliance risks. Existing defenses typically force a...

PerceptFence: Content-Mediation Architecture and Deterministic Coverage for Screen-Share AI Assistants

Live screen-share AI assistants observe raw screen and speech streams, but users have little runtime control over what an assistant may observe, retain, or disclose. Prompt-level privacy settings are insufficient because sensitive content enters through the capture stream. We present PerceptFence...

WordPress Bookly plugin < 28.3 - Unauthenticated Customer PII Update vulnerability

Unauthenticated Customer PII Update vulnerability discovered by Artus KG in WordPress Plugin Bookly versions 28.3...

CVE-2026-86837 Bookly < 28.3 - Unauthenticated Customer PII Update via Verification Bypass

The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information such as name, email and address...

CVE-2026-86837

The Bookly WordPress plugin versions prior to 28.3 contains a vulnerability where it fails to properly verify a customer's identity during personal information updates. An unauthenticated attacker who possesses a customer's primary identifier can exploit this verification bypass to overwrite sens...

CVE-2026-86837 Bookly < 28.3 - Unauthenticated Customer PII Update via Verification Bypass

The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information such as name, email and address...

Ivanti Endpoint Manager Mobile (EPMM) - Authentication Bypass

Ivanti Endpoint Manager Mobile EPMM, formerly MobileIron Core, through 11.10 allows remote attackers to obtain PII, add an administrative account, and change the configuration because of an authentication bypass, as exploited in the wild in July 2023. A patch is available. id: CVE-2023-35078 info...

WordPress Newsletters plugin < 4.18.1 - Unauthenticated Subscriber Record Overwrite and PII Disclosure vulnerability

Unauthenticated Subscriber Record Overwrite and PII Disclosure vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Newsletters versions 4.18.1...

Formie: Missing authorization on sent notification resend modal exposes submission PII

Impact The control panel action formie/sent-notifications/get-resend-modal-content SentNotificationsController::actionGetResendModalContent performed only requireAcceptsJson and loaded a SentNotification by request id without permission or object-level authorization checks. Any authenticated user...

GHSA-9RG8-2WVR-FGJH Formie: Missing authorization on sent notification resend modal exposes submission PII

Impact The control panel action formie/sent-notifications/get-resend-modal-content SentNotificationsController::actionGetResendModalContent performed only requireAcceptsJson and loaded a SentNotification by request id without permission or object-level authorization checks. Any authenticated user...

CVE-2026-90901

Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint administrator/index.php?option=comeasystore&task=media.deleteImage parsed the ids parameter as a comma-separated string and implode...

CVE-2026-90899

Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping details full...

CVE-2026-90901 Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0

Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint administrator/index.php?option=comeasystore&task=media.deleteImage parsed the ids parameter as a comma-separated string and implode...

EUVD-2026-85557

Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping detai...

CVE-2026-90901

The Easy Store extension (versions 1.0.0-3.0.0 ) for Joomla by joomshaper.com is vulnerable to an SQL Injection due to the lack of authentication, session validation, or ownership checks on the checkout.searchGuestUser endpoint. An unauthenticated attacker can provide an email address to query th...

CVE-2026-90901 Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0

Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint administrator/index.php?option=comeasystore&task=media.deleteImage parsed the ids parameter as a comma-separated string and implode...

CVE-2026-90899 Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0

Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping details full...

CVE-2026-90899 Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0

Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping details full...

CVE-2026-90899

The Easy Store extension (versions 1.0.0-3.0.0 ) for Joomla by joomshaper.com contains an Insecure Direct Object Reference (IDOR) vulnerability. The checkout.searchGuestUser endpoint allows unauthenticated attackers to query guest checkout records using only an email address. Because the server l...