Blinko <= 1.8.3 - User Information Leak

Blinko = 1.8.4 contains an information disclosure caused by a publicly accessible endpoint exposing user information including usernames, roles, and account creation dates, letting remote attackers access sensitive user data, exploit requires no special privileges. id: CVE-2026-23486 info: name:...

CVE-2026-73406

Budibase (open‑source low‑code platform) contains an unauthenticated information disclosure in GET /api/global/users/tenant/:id prior to version 3.39.32. The tenantUserLookup could return a full PlatformUser document to any unauthenticated caller, exposing email, user identifiers, tenant identifi...

CVE-2026-73406 Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint

Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLICENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier,...

CVE-2026-73406

Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLICENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier,...

CVE-2026-73406 Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint

Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLICENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier,...

EUVD-2026-57095

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server,...

PT-2026-71263

Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC ENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier,...

EUVD-2026-54893

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthenticated users to delete the generated album export ZIP archives it stores...

CVE-2026-17014

The CVE-2026-17014 entry affects the WP Photo Album Plus WordPress plugin prior to 9.2.07.002. The public REST endpoint action lacks capability or nonce checks, allowing unauthenticated users to delete generated album export ZIP archives stored by the plugin. This is the root cause and directly e...

CVE-2026-16558

The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved, allowing users with the Contributor role and above to store JavaScript that executes in th...

CVE-2026-16558 YMC Filter < 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema

The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved, allowing users with the Contributor role and above to store JavaScript that executes in th...

EUVD-2026-54733

The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved, allowing users with the Contributor role and above to store JavaScript that executes in th...

CVE-2026-16558

The CVE-2026-16558 vulnerability affects the YMC Filter WordPress plugin prior to version 3.12.8. It allows stored XSS via a layout builder setting because the value is not sanitized/escaped before output on a public endpoint, and object ownership is not verified when the setting is saved. This e...

PT-2026-67665

Name of the Vulnerable Software and Affected Versions The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin versions prior to 1.8.2 Description An unauthenticated user can upload arbitrary files because the plugin fails to validate th...

CVE-2026-14839 Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure

The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...

PT-2026-67051

The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished draft, pending, private, and...

CVE-2026-14483

The CVE-2026-14483 entry describes an unauthenticated Arbitrary File Upload in the Realtyna Organic IDX plugin + WPL Real Estate (

EUVD-2026-51404

The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via the upload function. This is due to missing file type validation in the upload function, combined with a publicly accessible I/O endpoint...

GHSA-HR66-5MQR-8MPX Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint

Summary The Budibase Worker service exposes a public, unauthenticated API endpoint GET /api/global/users/tenant/:id that returns sensitive user information including tenantId, userId, email, and ssoId. The endpoint is registered in the PUBLICENDPOINTS list with a TODO comment acknowledging it...

Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint

Summary The Budibase Worker service exposes a public, unauthenticated API endpoint GET /api/global/users/tenant/:id that returns sensitive user information including tenantId, userId, email, and ssoId. The endpoint is registered in the PUBLICENDPOINTS list with a TODO comment acknowledging it...