CVE-2026-16984 WP Legal Pages < 3.7.1 - Unauthenticated API Secret Disclosure

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secr...

CVE-2026-16984

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin (versions before 3.7.1 ) is vulnerable to an unauthenticated API secret disclosure . The root cause is a missing authorization check on a REST route that returns stored account data...

CVE-2026-16984 WP Legal Pages < 3.7.1 - Unauthenticated API Secret Disclosure

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secr...

EUVD-2026-66271

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secr...

CVE-2026-80194

Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route reportprojectviewexport. The authorization guards are attached to the sibling invoke method rather than at the class level, so the export route inherits no authorization checks. Any...

CVE-2026-16984: Improper Access Control

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secr...

PT-2026-81948

The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secr...

PT-2026-82367

Name of the Vulnerable Software and Affected Versions Entity PDF versions 0.0.0 through 2.1.5 Description Missing authorization in the Entity PDF module allows forceful browsing. The module fails to check entity view access when fetching a PDF route, which may allow a user to access a PDF of an...

PT-2026-82369

Name of the Vulnerable Software and Affected Versions Drupal Digital Signage Framework versions 0.0.0 through 2.6.1 Description A missing authorization issue allows forceful browsing. The module provides a route for signage devices to refresh dynamic blocks on a display, but it fails to verify if...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-104533)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104533 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't ignore error route in local/main tables. When CONFIGIPMULTIPLETABLES is enabled...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104599)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104599 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't ignore error route in local/main tables. When CONFIGIPMULTIPLETABLES is enabled...

CVE-2026-80194

Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route (report_project_view_export). Authorization guards are attached to the sibling __invoke method rather than at the class level, leaving the export route without any authorization checks. As...

CVE-2026-80194 Kimai before 2.64.0 Missing Authorization via ProjectViewController export

Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route reportprojectviewexport. The authorization guards are attached to the sibling invoke method rather than at the class level, so the export route inherits no authorization checks. Any...

CVE-2026-80194 Kimai before 2.64.0 Missing Authorization via ProjectViewController export

Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route reportprojectviewexport. The authorization guards are attached to the sibling invoke method rather than at the class level, so the export route inherits no authorization checks. Any...

CVE-2026-80194 Kimai before 2.64.0 Missing Authorization via ProjectViewController export

Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route reportprojectviewexport. The authorization guards are attached to the sibling invoke method rather than at the class level, so the export route inherits no authorization checks. Any...

CVE-2026-79776

rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials...

GHSA-VFP3-V2GW-7WFQ Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

Summary Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path preserving %2F as-is, while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls...

Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

Summary Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path preserving %2F as-is, while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls...

CVE-2026-79776

rclone before 1.75.0 mounts its pprof debug handler as a standalone router route, bypassing the fail-closed authentication rule applied by the main handler. An unauthenticated attacker can access the /debug/pprof/cmdline endpoint over the network to retrieve the full process argv , which includes...

PT-2026-81907

Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route report project view export. The authorization guards are attached to the sibling invoke method rather than at the class level, so the export route inherits no authorization checks. Any...