CVE-2026-16957

The Slim SEO WordPress plugin versions prior to 4.9.11 contains a vulnerability where a post-meta preview feature fails to properly restrict access. The component verifies only read access instead of ensuring the user is authorized to edit the specific post. This allows users with the Contributor...

PT-2026-69263

Name of the Vulnerable Software and Affected Versions Slim SEO versions prior to 4.9.11 Description A post-meta preview feature fails to restrict access to posts that the user is authorized to edit, verifying only read access. This allows users with the Contributor role to read arbitrary post met...

CVE-2026-14943

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read...

CVE-2026-14943

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin (versions before 2.8.4 ) contains a vulnerability where it fails to restrict REST API access to authenticated users when a specific option is enabled. This allows unauthenticated visitors to ...

CVE-2026-14943 Password Protected < 2.8.4 - Unauthenticated Sensitive Information Exposure via REST API

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read...

CVE-2026-14943

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read...

CVE-2026-14943 Password Protected < 2.8.4 - Unauthenticated Sensitive Information Exposure via REST API

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read...

WP 7.0.x - Unauthenticated Password Protected Post Comment Disclosure via Gutenberg Latest Comments Block

Description Gutenberg does not check whether a post is password protected before displaying the full text of its comments, which could allow unauthenticated users to read comments left on password protected posts. The affected block ships both in the Gutenberg plugin and, bundled, in WordPress co...

CVE-2026-14943: Exposure of Sensitive Information to an Unauthorized Actor

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read...

CVE-2025-15674

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the editposts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of...

CVE-2026-16604

The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before verifying the password, allowing unauthenticated users to recover the protected content without knowing the password...

EUVD-2026-53105

The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before verifying the password, allowing unauthenticated users to recover the protected content without knowing the password...

PT-2026-67981

Name of the Vulnerable Software and Affected Versions Passster WordPress plugin versions prior to 4.3.6 Description The plugin outputs password-protected block content in the public page response before the password verification process is completed. This allows unauthenticated users to recover...

CVE-2026-16604: Exposure of Sensitive Information to an Unauthorized Actor

The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before verifying the password, allowing unauthenticated users to recover the protected content without knowing the password...

Duplicate Advisory: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7j72-f6wg-cxw6. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning...

CVE-2026-68584

SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeadingTransaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retriev...

CVE-2026-68584 SiYuan before v3.7.3 Authentication Bypass via Content Endpoints

SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeadingTransaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retriev...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the PKMACValueVerifier.isValid and ProtectedPKIMessage.verify verification paths, where PKMACBuilder's default constructor leaves maxIterations = 0 and disables the iteration-count...

PT-2026-68858

Name of the Vulnerable Software and Affected Versions Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin versions prior to 2.8.4 Description A missing authentication check in the REST API access filter allows unauthenticated visitors to bypass th...

SUSE CVE-2026-34453

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the publish service exposes bookmarked blocks from password-protected documents to unauthenticated visitors. In publish/read-only mode, /api/bookmark/getBookmark filters bookmark results by calling...