CVE-2026-76268: Missing Authentication for Critical Function

In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer REST Application Programming Interface API on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerabili...

CVE-2026-76267: Improper Output Neutralization for Logs

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could inject forged entries into the app log through the Representational State Transfer REST API. The vulnerability is possible because Splunk App for Splunk O11y Cloud...

CVE-2026-76265: Improper Access Control

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a user who does not hold the "admin" or "power" Splunk roles could access privileged Splunk Secure Gateway functionality. With this access, the user could...

PT-2026-107700

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Description An authorization bypass exists in the Representational State Transfer REST API. A user with the edit...

WordPress Core <= 7.1.2 - Author+ Broken Access Control to Sticky Posts via REST API vulnerability

Author+ Broken Access Control to Sticky Posts via REST API vulnerability discovered by Anthropic in WordPress core versions = 7.1.2...

Arbitrary Code Execution

Apache Syncope is vulnerable to an Arbitrary Code Execution. The vulnerability is due to imported BPMN processes allowing unsandboxed Groovy scriptTask execution, which allows an attacker with sufficient administrative entitlements to import and start a malicious BPMN process through the REST API...

CVE-2026-39794

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API = 1.6.3 versions...

CVE-2026-39794 WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API = 1.6.3 versions...

CVE-2026-39794 WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API = 1.6.3 versions...

EUVD-2026-93038

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API = 1.6.3 versions...

CVE-2026-39794

The WooCommerce Multivendor Marketplace – REST API plugin for WordPress (versions

CVE-2026-105305

A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by ...

CVE-2026-105305

A flaw exists in the OIDC implementation of Keycloak , specifically within the Device Authorization Grant flow . The root cause is that the flow fails to validate the minimum authentication level defined in client configurations. Consequently, an attacker possessing a stolen user password can byp...

EUVD-2026-93019

A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by ...

CVE-2026-105305 Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement

A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by ...

CVE-2026-105305 Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement

A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by ...

CVE-2026-105305

A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by ...

CVE-2026-105701

The ACPT Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes ...

CVE-2026-105701 ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template

The ACPT Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes ...

EUVD-2026-92986

The ACPT Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes ...