CVE-2026-16578 Admin Safety Guard < 1.4.0 - Unauthenticated User Data Disclosure via 2fa/app/users REST Route

The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, ema...

EUVD-2026-54737

The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, ema...

CVE-2026-16578

The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, ema...

CVE-2026-16578 Admin Safety Guard < 1.4.0 - Unauthenticated User Data Disclosure via 2fa/app/users REST Route

The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, ema...

CVE-2026-16578

The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin, in versions before 1.4.0 , is vulnerable to unauthenticated user data disclosure. The root cause is a missing capability check on the 2fa/app/users REST API endpoint. This flaw allows unauthentic...

CVE-2026-71850

Hono is a Web application framework that provides support for any JavaScript runtime. From 3.8.0 to 4.12.33, memo from hono/jsx retains the result of a server side render and reuses it for later renders with comparator equal props, and request scoped values read inside the component take no part ...

CVE-2026-71850 Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

Hono is a Web application framework that provides support for any JavaScript runtime. From 3.8.0 to 4.12.33, memo from hono/jsx retains the result of a server side render and reuses it for later renders with comparator equal props, and request scoped values read inside the component take no part ...

CVE-2026-71850

Hono is a Web application framework that provides support for any JavaScript runtime. From 3.8.0 to 4.12.33, memo from hono/jsx retains the result of a server side render and reuses it for later renders with comparator equal props, and request scoped values read inside the component take no part ...

CVE-2026-71850 Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

Hono is a Web application framework that provides support for any JavaScript runtime. From 3.8.0 to 4.12.33, memo from hono/jsx retains the result of a server side render and reuses it for later renders with comparator equal props, and request scoped values read inside the component take no part ...

CVE-2026-71850

Hono CVE-2026-71850 affects the Hono Web framework (3.8.0–4.12.33). memo() retains SSR output for later renders and reuses it when controls with identical props are rendered, while request-scoped values read during rendering (e.g., JSX Context via createContext/useContext, useRequestContext from ...

CVE-2026-71850 Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

Hono is a Web application framework that provides support for any JavaScript runtime. From 3.8.0 to 4.12.33, memo from hono/jsx retains the result of a server side render and reuses it for later renders with comparator equal props, and request scoped values read inside the component take no part ...

EUVD-2026-54298

The DataPress Dataverse Integration WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher...

GHSA-RVMM-V933-JGXQ Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

ChartsController::actionGetNewUsersData at /actions/charts/get-new-users-data is missing a requirePermission'viewUsers' authorization check. Any authenticated control panel user, regardless of permissions beyond accessCp, can POST to this endpoint to receive time-series user registration counts f...

CVE-2026-65552

Subscriber PHP Object Injection in Export User Data = 2.2.6 versions...

CVE-2026-65552

CVE-2026-65552 concerns the WordPress Export User Data plugin (versions

CVE-2026-65552

Subscriber PHP Object Injection in Export User Data = 2.2.6 versions...

CVE-2026-65552 WordPress Export User Data plugin <= 2.2.6 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in Export User Data = 2.2.6 versions...

EUVD-2025-210623

SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass authorization controls and gain unauthorized READ and WRITE access to other users' personal information. The API fails to validate that the...

CVE-2026-65552: Deserialization of Untrusted Data

Subscriber PHP Object Injection in Export User Data = 2.2.6 versions...

CVE-2025-63822

SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass authorization controls and gain unauthorized READ and WRITE access to other users' personal information. The API fails to validate that the...