CVE-2026-61802

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low-privilege API user can read the cleartext cluster key from a configuration endpoint that fails to redact it. The REST API provides a...

PT-2026-82886

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not check authorisation when returning question bank entries through one of its REST API routes, allowing users with a role as low as Contributor to read the questions, hints and correct answer keys of quizzes belonging to other...

CVE-2026-79615: Authorization Bypass Through User-Controlled Key

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not check authorisation when returning question bank entries through one of its REST API routes, allowing users with a role as low as Contributor to read the questions, hints and correct answer keys of quizzes belonging to other...

CVE-2026-61802 Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low-privilege API user can read the cleartext cluster key from a configuration endpoint that fails to redact it. The REST API provides a...

CVE-2026-81729

Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete in htdocs/api/class/apidocuments.class.php calls dolchecksecureaccessdocument with the mode argument 'read' when handling DELETE /api/index.php/documents, while the sibling builddoc path...

CVE-2026-81729 Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion

Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete in htdocs/api/class/apidocuments.class.php calls dolchecksecureaccessdocument with the mode argument 'read' when handling DELETE /api/index.php/documents, while the sibling builddoc path...

CVE-2026-81729 Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion

Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete in htdocs/api/class/apidocuments.class.php calls dolchecksecureaccessdocument with the mode argument 'read' when handling DELETE /api/index.php/documents, while the sibling builddoc path...

CVE-2026-81729

In Dolibarr before 23.0.4 , the REST API document deletion endpoint (DELETE /api/index.php/documents) checks permissions with the wrong mode. Documents::delete() in htdocs/api/class/api_documents.class.php calls dol_check_secure_access_document() with mode read instead of write , meaning an authe...

CVE-2026-81729 Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion

Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete in htdocs/api/class/apidocuments.class.php calls dolchecksecureaccessdocument with the mode argument 'read' when handling DELETE /api/index.php/documents, while the sibling builddoc path...

EUVD-2026-67234

Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete in htdocs/api/class/apidocuments.class.php calls dolchecksecureaccessdocument with the mode argument 'read' when handling DELETE /api/index.php/documents, while the sibling builddoc path...

SUSE CVE-2026-55228

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforce the scope of project- and workspace-scoped teams, allowing a user to submit invalid team configurations through the API. By assigning...

WordPress Content Protector (Passster) plugin < 4.3.6 - Unauthenticated Category-Locked Content Disclosure via Core REST API vulnerability

Unauthenticated Category-Locked Content Disclosure via Core REST API vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Passster versions 4.3.6...

WordPress Dokan plugin < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API vulnerability

Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Dokan versions 5.0.9...

CVE-2026-81679: Exposure of Sensitive Information to an Unauthorized Actor

OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a...

PT-2026-82746

Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete in htdocs/api/class/api documents.class.php calls dol check secure access document with the mode argument 'read' when handling DELETE /api/index.php/documents, while the sibling builddoc...

PT-2026-82580

OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a...

CVE-2024-46627

CVE-2024-46627 - Controllo di accesso errato in BECN DATAGERRY v2.2 consente agli attaccanti di eseguire comandi arbitrari tramite richieste web appositamente create. DATAGERRY v2.2 non dispone di controllo degli accessi nella REST API per i seguenti endpoint: /rest/users//settings/ GET, POST...

CVE-2026-55228

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforce the scope of project- and workspace-scoped teams, allowing a user to submit invalid team configurations through the API. By assigning...

CVE-2026-66003

Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0, an access control bypass in the REST API allows a user to read data from Linked DocTypes that they are not authorized to access. When a document references another document through a Link...

CVE-2026-55228

Weblate versions prior to 2026.7 contain a WebIDOR (Insecure Direct Object Reference) vulnerability in the GroupViewSet REST API endpoint. The API did not properly enforce the scope of project- and workspace-scoped teams, allowing an authenticated user with project-manager privileges to submit un...