PT-2026-70129

Name of the Vulnerable Software and Affected Versions Ladybird Web Solution Faveo Helpdesk version 2.0.3 Description A broken access control issue exists in the v1 REST API. The API verifies if a requested ticket exists but fails to verify if the authenticated user owns that ticket. This allows a...

CVE-2026-72554: Improper Access Control

A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging to other customers via the v1 REST API. The API verifies the existence of the requested ticket but not ownership, enabling any authenticat...

EUVD-2026-55847

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the channels.convertToTeam REST endpoint allows an authenticated registered user with the create-team permission to convert an unrelated public...

CVE-2026-72919

Rocket.Chat prior to versions 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1 exposes a broken access control in the channels.convertToTeam REST endpoint. An authenticated user with the create-team permission could convert an unrelated public channel by providing channelName instead ...

BloodHound v9.6.0-rc2

BloodHound is a monolithic web application composed of an embedded React frontend with Sigma.js and a Go based REST API backend. It is deployed with a Postgresql application database and a Neo4j graph database, and is fed by the SharpHound and AzureHound data collectors. BloodHound leverages grap...

xss2shell

XSS2Shell — WordPress Pre-Auth XSS → RCE Chain PoC CVE-2026...

CVE-2026-18960

The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API...

CVE-2026-17541

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them...

CVE-2026-17018

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

CVE-2026-18786 CheckView < 2.3.2 - Administrator Account Creation via REST API Authentication Bypass

The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible f...

CVE-2026-14238 Vitepos < 3.6.0 - Admin+ SQL Injection via product-details-report

The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection...

CVE-2026-17020 Salon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII Disclosure

The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user including a Subscriber or self-registered customer account to disclose...

CVE-2026-17020 Salon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII Disclosure

The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user including a Subscriber or self-registered customer account to disclose...

EUVD-2026-55011

The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API...

CVE-2026-17018 CubeWP Framework <= 1.1.30 - Contributor+ Arbitrary Post and User Meta Disclosure via IDOR

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

CVE-2026-17018

The CubeWP Framework WordPress plugin (versions through 1.1.30 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw due to a lack of per-object read authorization checks and missing restrictions on metadata keys. This allows users with the Contributor role or higher to access arbitr...

CVE-2026-17541

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them...

CVE-2026-17541 Bit File Manager < 6.9.1 - Unauthenticated File Activity Log Disclosure

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them...

PT-2026-69359

Name of the Vulnerable Software and Affected Versions CubeWP Framework WordPress plugin versions prior to 1.1.31 Description An issue exists where a REST API endpoint fails to perform per-object read authorization checks and does not restrict the metadata keys that can be requested. This allows...

PT-2026-69366

Name of the Vulnerable Software and Affected Versions File Manager WordPress plugin versions prior to 6.9.1 Description Lack of authorization checks on a REST API route allows unauthenticated users to access the file activity log. This leads to the disclosure of file operations performed on the...