EUVD-2026-76989

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete...

CVE-2026-90768 CAPEv2 through commit 471ee4b REST API Task Endpoints Missing Ownership Check

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete...

CVE-2026-90768 CAPEv2 through commit 471ee4b REST API Task Endpoints Missing Ownership Check

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete...

CVE-2026-90768

CAPEv2 (malware analysis platform) through commit 471ee4b fails to validate task ownership in its REST API task view and delete endpoints . An authenticated user can enumerate all tasks in the system and read or delete analyses submitted by other users, without any ownership verification. The CVS...

PT-2026-90961

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every...

PT-2026-90985

A vulnerability was found in getzep graphiti up to 0.30.2. Affected is an unknown function of the file server/graph service/main.py of the component REST API. The manipulation results in improper authentication. The attack can be launched remotely. The pull request to fix this issue awaits...

PT-2026-90835

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete...

CVE-2026-74933: Missing Authorization

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every...

CVE-2026-90768: Missing Authorization

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete...

CVE-2026-90601: Improper Authentication

A vulnerability was found in getzep graphiti up to 0.30.2. Affected is an unknown function of the file server/graphservice/main.py of the component REST API. The manipulation results in improper authentication. The attack can be launched remotely. The pull request to fix this issue awaits...

CVE-2026-87888

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...

CVE-2026-77753

The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site ov...

CVE-2026-81742

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...

CVE-2026-87888 YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...

CVE-2026-87891 Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...

EUVD-2026-76801

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...

CVE-2026-87888 YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...

CVE-2026-87891 Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...

CVE-2026-87891

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...

CVE-2026-87888

The YayPricing WordPress plugin (versions before 3.5.7 ) is vulnerable to a Stored XSS flaw due to a missing authorization check on a REST route used to save pricing rules. This allows users with the subscriber role and above to inject and store malicious JavaScript. If an administrator views the...