EUVD-2026-58518

OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs...

GHSA-QH9R-J7RP-4X2M OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

Summary The OpenChoreo control-plane cluster-gateway served its caller-facing management APIs on the same network listener that accepts data-plane agent connections. In the multi-cluster topology that listener is published outside the cluster, and the management APIs did not authenticate the...

EUVD-2026-63663

Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection...

EUVD-2026-70253

A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionality of the file web.xml of the component Admin Console/DPO Compliance Console. Executing a manipulation can lead to missing authentication. It is possible to launch the attack...

CVE-2026-52832

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default NOP auth mode. The spec.handler field e.g., mymodule:myfunction is parsed by functionconfig.ParseHandler which split...

CVE-2026-77794

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, allowing unauthenticated users to register without paying and obtain an activated account holding the role the form grants...

CVE-2026-2688

The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints...

CVE-2025-15481

The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails...

CVE-2025-15485

The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc...

CVE-2025-15489

The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...

GHSA-2V6V-25FM-P4FG SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control

Impact The filer registered the IAM gRPC service SeaweedIdentityAccessManagement with no authentication. Any client able to reach the filer gRPC port could invoke IAM RPCs — CreateUser, CreateAccessKey, PutUserPolicy, and related calls — to mint credentials and grant itself S3 administrative...

CVE-2025-15489 Passster < 4.2.24 - Password Protection Bypass

The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...

EUVD-2025-210831

The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...

CVE-2025-15489

The Passster WordPress plugin before version 4.2.24 contains an improper input handling flaw in an AJAX action , allowing unauthenticated users to retrieve the value of password-protected content. This constitutes a password protection bypass , with a CVSS 3.1 score of 5.3 (Medium) reflecting net...

CVE-2025-15489 Passster < 4.2.24 - Password Protection Bypass

The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...

EUVD-2025-210830

The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc...

CVE-2025-15485

CVE-2025-15485 affects the Auto x LINE WordPress plugin through version 1.0.0 . The plugin lacks authorization checks on certain REST API endpoints , enabling unauthenticated users to invoke them and update plugin settings or clear logs . The vulnerability carries a CVSS v3.1 score of 8.2 (HIGH) ...

CVE-2025-15481

The Notification Bar for WordPress plugin (slug 8-degree-notification-bar) through version 1.1.8 exposes an unauthenticated CSV export script at inc/backend/blocks/export-csv.php, allowing anyone to download all stored subscriber email addresses without authentication. The vulnerability is rated ...

EUVD-2025-210829

The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails...

CVE-2026-78153 Restrict User Access 2.6 - 2.8 - Unauthenticated Content Protection Bypass via REST API Route Normalization

The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users...