CVE-2026-104467 YesWiki before 4.6.7 Authorization Bypass via Public API Mode

YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/updateconfig and api/archives to overwrite...

CVE-2026-104467 YesWiki before 4.6.7 Authorization Bypass via Public API Mode

YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/updateconfig and api/archives to overwrite...

PT-2026-104277

YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/update config and api/archives to overwrite...

CVE-2026-89141

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the 'mediaId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2026-89141: Authorization Bypass Through User-Controlled Key

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the 'mediaId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated...

GHSA-MF8R-WM2W-F8C5 phpMyFAQ public FAQ APIs expose inactive FAQ content

Affected Product phpMyFAQ Affected Versions - Confirmed affected: 4.1.4, API v3.1. - Confirmed affected: current main / 4.2-style source, API v4.0, for GET /api/v4.0/faqs/tags/tagId when api.onlyActiveFaqs=true. Patched Versions 4.1.5. Description The public FAQ API applies inconsistent active =...

phpMyFAQ public FAQ APIs expose inactive FAQ content

Affected Product phpMyFAQ Affected Versions - Confirmed affected: 4.1.4, API v3.1. - Confirmed affected: current main / 4.2-style source, API v4.0, for GET /api/v4.0/faqs/tags/tagId when api.onlyActiveFaqs=true. Patched Versions 4.1.5. Description The public FAQ API applies inconsistent active =...

CVE-2026-79660

Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model . Unauthenticated attackers can harvest all commenter emails by calling the /api/comments and /api/comments/public endpoints without any auth...

CVE-2026-79660 Ech0 before 4.7.3 Email Disclosure via Public API

Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model. Unauthenticated attackers can harvest all commenter emails by calling the /api/comments and /api/comments/public endpoints without...

CVE-2026-79660 Ech0 before 4.7.3 Email Disclosure via Public API

Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model. Unauthenticated attackers can harvest all commenter emails by calling the /api/comments and /api/comments/public endpoints without...

CVE-2026-79660 Ech0 before 4.7.3 Email Disclosure via Public API

Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model. Unauthenticated attackers can harvest all commenter emails by calling the /api/comments and /api/comments/public endpoints without...

PT-2026-80640

Summary Glances provides as dict secure explicitly designed for unauthenticated API access, with a docstring stating it returns "a sanitised copy of the configuration dict" where "Sensitive keys in remaining sections are replaced by ''". However, the implementation only checks KEY names against a...

CVE-2026-62377

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heifcontextreadfrommemory can leave the context with no registered sequence tracks and crash when heifcontextgettrackctx, 0 is called. HeifContext::gettrack in libheif/context.cc...

CVE-2026-62377 libheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110)

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heifcontextreadfrommemory can leave the context with no registered sequence tracks and crash when heifcontextgettrackctx, 0 is called. HeifContext::gettrack in libheif/context.cc...

CVE-2026-62377 libheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110)

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heifcontextreadfrommemory can leave the context with no registered sequence tracks and crash when heifcontextgettrackctx, 0 is called. HeifContext::gettrack in libheif/context.cc...

CVE-2026-58431 Public-only API token restriction is not enforced on team API routes

Public-only API token restriction is not enforced on team API routes...

CVE-2026-58417

The Gitea REST API contains an information disclosure vulnerability where it exposes organization membership of private organizations to the public. Specifically, the GET endpoint /orgs/{org}/public_members/{username} reveals whether a specific user belongs to a private organization, even though ...

CVE-2026-73406 Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint

Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLICENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier,...

CVE-2026-16955

The AI Engine WordPress plugin versions prior to 3.6.6 is vulnerable to an arbitrary file read via a path traversal flaw. The root cause is a failure to confine caller-supplied file paths before the plugin reads and forwards content to external services. This allows users with subscriber-level ac...

CVE-2026-10524

The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at...