EUVD-2026-87769

stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages. Authenticated users can send five crafted role-mention messages to terminate all acknowledgement workers, disabling push notifications and mention badges...

CVE-2026-100675

Versions of stoatchat prior to 0.15.5 are susceptible to a denial of service vulnerability within the acknowledgement worker during the processing of mass mention messages. An authenticated user can trigger this by sending five specially crafted role-mention messages , which results in the termin...

CVE-2026-100632 Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery

Parse Server is an open-source backend server. In versions = 9.0.0 and 9.10.1-alpha.8, and in versions 8.6.89, LiveQuery evaluates the protectedFields class-level permission against an incompletely resolved caller identity: the subscriber's roles are not resolved, and when a subscription does not...

CVE-2026-100632 Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery

Parse Server is an open-source backend server. In versions = 9.0.0 and 9.10.1-alpha.8, and in versions 8.6.89, LiveQuery evaluates the protectedFields class-level permission against an incompletely resolved caller identity: the subscriber's roles are not resolved, and when a subscription does not...

CVE-2026-100618 Capgo App Icon Update Privilege Escalation via Service-Role Worker

Capgo capgo.app is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled icon value, normalizes it, and stores it in public.apps.iconurl without verifying that the image path belongs to the target app's own image namespace e.g...

CVE-2026-100618 Capgo App Icon Update Privilege Escalation via Service-Role Worker

Capgo capgo.app is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled icon value, normalizes it, and stores it in public.apps.iconurl without verifying that the image path belongs to the target app's own image namespace e.g...

EUVD-2026-87714

Capgo capgo.app blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restriction can be bypassed indirectly. A principal holding an app-scoped upload/write/all API key upload+ rights or an authenticated user with write+ rights on an app...

CVE-2026-100619

The Capgo (capgo.app) platform is vulnerable to OTA manifest poisoning because row-level security policies on the public.manifest table can be bypassed indirectly. An attacker with an app-scoped upload/write/all API key or write+ rights can update public.app_versions.manifest for versions using t...

EUVD-2026-87713

Capgo capgo.app is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled icon value, normalizes it, and stores it in public.apps.iconurl without verifying that the image path belongs to the target app's own image namespace e.g...

CVE-2026-100611 Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list

Capgo capgo.app backend, versions ≤ 12.261.0 improperly restricts which roles the apikeymanager organization role may bind to newly created API keys. When an authenticated user holding only apikeymanager permissions org.manageapikeys and org.read calls POST /apikey with a JWT session, the only...

CVE-2026-100611 Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list

Capgo capgo.app backend, versions ≤ 12.261.0 improperly restricts which roles the apikeymanager organization role may bind to newly created API keys. When an authenticated user holding only apikeymanager permissions org.manageapikeys and org.read calls POST /apikey with a JWT session, the only...

CVE-2026-96525

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST routes, allowing users with the Contributor role to modify, delete and create site-wide workflow configuration, including workflow...

CVE-2026-96526

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users'...

CVE-2026-96531

The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing users with the Author role and above to store an event-handler attribute that executes scripts in the browser of any user,...

CVE-2026-96531 Optimole 4.0.0 - 4.2.12 - Author+ Stored XSS via Video Player Block

The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing users with the Author role and above to store an event-handler attribute that executes scripts in the browser of any user,...

CVE-2026-96531

The Optimole WordPress plugin (versions 4.0.0 - 4.2.12 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element. This allows users with the Author r...

EUVD-2026-87538

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users'...

CVE-2026-96526

The MCP Server for WordPress plugin for WordPress, in versions before 1.8.2 , is susceptible to an authorization vulnerability. The root cause is a lack of object-level authorization checks on one of its workflow REST routes (specifically workflows/run). This flaw allows users with the Contributo...

CVE-2026-96525 MCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership Check

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST routes, allowing users with the Contributor role to modify, delete and create site-wide workflow configuration, including workflow...

CVE-2026-96525

The MCP Server for WordPress plugin for WordPress, in versions before 1.8.2 , is vulnerable to unauthorized configuration modification. The root cause is a failure to perform ownership or sufficient capability checks on its workflow create, update, and delete REST routes. This flaw allows users w...