PT-2026-67664

The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests a...

CVE-2026-63455: Missing Authentication for Critical Function

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive...

CVE-2026-63456: Improper Authentication

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive...

CVE-2026-16547: Improper Access Control

The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests a...

PT-2026-67776

Name of the Vulnerable Software and Affected Versions HPE Networking SD-WAN Orchestrator affected versions not specified Description Multiple issues in the REST API interface allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. This could...

PT-2026-67777

Name of the Vulnerable Software and Affected Versions HPE Networking SD-WAN Orchestrator affected versions not specified Description Multiple issues in the REST API interface allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. This could...

CVE-2026-68981

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

CVE-2026-68980

Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework...

CVE-2026-68980

CVE-2026-68980 affects Apache NiFi 2.0.0–2.10.0. The issue is an authorization bypass in Asset management for Parameter Contexts via the REST API: deletion of an Asset is authorized by the provided Parameter Context Identifier without validating the Asset Identifier against the stored one. This c...

CVE-2026-68979

Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization wa...

CVE-2026-48031

Technical details about CVE-2026-48031 are not publicly provided in the supplied documents. The go-base JWT-secret issue is described at a high level; monitor for updates for concrete affected versions, root cause, and fixes.

CVE-2026-16563 Academy LMS < 3.8.3 - Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST Endpoint

The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student Subscriber-level account to disclose the content of arbitrary lessons, including lessons of...

CVE-2026-16565 Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on its product-attribute REST write endpoints, allowing users with a Dokan vendor account to modify the product attributes and default attributes of any other vendor'...

CVE-2026-16563

The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student Subscriber-level account to disclose the content of arbitrary lessons, including lessons of...

CVE-2026-16563

The Academy LMS WordPress plugin (versions prior to 3.8.3 ) is vulnerable to an improper access control flaw in its REST API. The plugin fails to verify course enrollment or lesson publication status when returning a single lesson via the lessons REST endpoint . This allows users with a Subscribe...

CVE-2026-68979: Missing Authorization

Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization wa...

CVE-2026-68980: Incorrect Authorization

Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework...

CVE-2026-16563: Improper Access Control

The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student Subscriber-level account to disclose the content of arbitrary lessons, including lessons of...

PT-2026-68632

Name of the Vulnerable Software and Affected Versions Passster versions prior to 4.3.7 Description Low-privilege users with the edit posts capability can read globally password-protected content through the WordPress core REST API when global protection is enabled. This allows any user with...

PT-2026-68858

Name of the Vulnerable Software and Affected Versions Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin versions prior to 2.8.4 Description A missing authentication check in the REST API access filter allows unauthenticated visitors to bypass th...