CVE-2026-71509: Missing Authorization

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authenticated attackers with expense-creation rights to bypass the approval workflow by directly setting approval status and approver identity fields. Attackers can...

PT-2026-80888

Name of the Vulnerable Software and Affected Versions phpIPAM versions prior to 1.8.2 Description An authentication bypass exists in the REST API due to an insecure object cache keying mechanism. The cache uses only the lookup value as a key and fails to include the searched column. This allows a...

PT-2026-81003

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 24.0.0 Description An improper authorization issue exists in the user REST API update endpoint. Attackers possessing user-write permissions can modify payroll-related data by exploiting an incomplete credential...

PT-2026-80999

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 24.0.0 Description An improper authorization issue exists in the Members REST API. Users with member-creation rights can reset the password of any account, including the system administrator, because the system fails...

PT-2026-81000

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 24.0.0 Description A broken object-level authorization issue exists in the REST API third-party site account write routes. Authenticated attackers with third-party creation rights can bypass per-object access checks,...

PT-2026-81002

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 24.0.0 Description A broken object-level authorization issue exists in the REST API company bank account write routes. This allows authenticated attackers with third-party creation rights to create, replace, or delet...

PT-2026-81006

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 24.0.0 Description A sensitive data exposure issue exists in the Members REST API. Authenticated attackers with member-read permissions can retrieve bcrypt password verifiers by querying member endpoints. This occurs...

PT-2026-81004

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 24.0.0 Description An improper authorization issue exists in the expense report REST API update endpoint. Authenticated attackers with expense-creation rights can bypass the approval workflow by directly modifying...

CVE-2026-71505: Authorization Bypass Through User-Controlled Key

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks tha...

traccar v6.15.2

Traccar Overview Traccar is an open source GPS tracking system. This repository contains Java-based back-end service. It supports more than 200 GPS protocols and more than 2000 models of GPS tracking devices. Traccar can be used with any major SQL database system. It also provides easy to use RES...

EUVD-2026-64605

The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the restendpoints filter via secureuserendpoints and...

CVE-2026-16149

The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the restendpoints filter via secureuserendpoints and...

CVE-2026-16149 Security Hardener <= 2.4.4 - Authenticated (Subscriber+) Privilege Escalation via REST API '/wp/v2/users' permission_callback Overwrite

The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the restendpoints filter via secureuserendpoints and...

CVE-2026-16149 Security Hardener <= 2.4.4 - Authenticated (Subscriber+) Privilege Escalation via REST API '/wp/v2/users' permission_callback Overwrite

The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the restendpoints filter via secureuserendpoints and...

CVE-2026-16149

Security Hardener for WordPress (all versions up to and including 2.4.4 ) contains a Missing Authorization flaw in its user-enumeration protection feature. The plugin's secure_user_endpoints() function hooks the rest_endpoints filter and overwrites the permission_callback on both /wp/v2/users and...

Exploit for CVE-2026-13736

CVE-2026-13736: NewPath WildApricotPress Add-on – Member Direc...

PT-2026-79745

The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the rest endpoints filter via secure user endpoints and...

CVE-2026-17559

The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an...

CVE-2026-17559

Passster (Content Protector) WordPress plugin versions before 4.3.9 contain an unauthenticated information disclosure vulnerability in its REST API path allowlist logic. The plugin compares its own public endpoint paths as an unanchored substring of the request URI rather than against the resolve...

EUVD-2026-63911

The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an...