CVE-2026-92570

reNgine through 2.2.0 contains an authorization bypass vulnerability in the GetFileContents API endpoint that allows any authenticated user to read bundled recon tool configuration files. Attackers with low-privilege Auditor roles can access files containing third-party API keys for services like...

CVE-2026-92570 reNgine through 2.2.0 Unauthorized Configuration File Read

reNgine through 2.2.0 contains an authorization bypass vulnerability in the GetFileContents API endpoint that allows any authenticated user to read bundled recon tool configuration files. Attackers with low-privilege Auditor roles can access files containing third-party API keys for services like...

CVE-2026-92570

reNgine through 2.2.0 has an authorization bypass in the GetFileContents API endpoint due to missing role-based permission checks. Any authenticated user with a low-privilege Auditor role can read bundled reconnaissance tool configuration files, exposing third-party API keys for SecurityTrails, S...

CVE-2026-92570 reNgine through 2.2.0 Unauthorized Configuration File Read

reNgine through 2.2.0 contains an authorization bypass vulnerability in the GetFileContents API endpoint that allows any authenticated user to read bundled recon tool configuration files. Attackers with low-privilege Auditor roles can access files containing third-party API keys for services like...

CVE-2026-87959

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI...

CVE-2026-87959 WPBot 8.7.2 - 8.7.5 - Subscriber+ Claude AI Settings Update

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI...

EUVD-2026-80212

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI...

CVE-2026-85569 Tutor LMS 2.7.1 - < 4.0.8 - Read-Only API Key Privilege Escalation via REST Request Misclassification

The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential, allowing the holder of a read-only key to act as the administrator account that issued it...

CVE-2026-85569 Tutor LMS 2.7.1 - < 4.0.8 - Read-Only API Key Privilege Escalation via REST Request Misclassification

The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential, allowing the holder of a read-only key to act as the administrator account that issued it...

CVE-2026-85569

The Tutor LMS WordPress plugin (versions before 4.0.8 ) is vulnerable to a Read-Only API Key Privilege Escalation flaw. The root cause is the plugin's failure to correctly determine if an incoming request is addressed to its own REST API , combined with a failure to enforce permissions recorded a...

CVE-2026-92803: Missing Authorization

LibreTranslate through 1.9.6 omits the accesscheck decorator from the downloadfile route, allowing unauthenticated access to translated files. Attackers can bypass API key requirements and abuse ban lists to download files without authentication on protected instances...

CVE-2026-87959: Improper Access Control

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI...

PT-2026-93313

The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, allowing users with subscriber-level access to overwrite those settings, including the API key used for the WPBot WordPress plugin before 8.7.6's outgoing AI...

CVE-2026-92760: Incorrect Authorization

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the mercure-info endpoint to receive visit data including referrer, user agent,...

PT-2026-94077

Name of the Vulnerable Software and Affected Versions LibreTranslate versions prior to 1.9.7 Description The download file route omits the access check decorator, which enables unauthenticated access to translated files. This allows attackers to bypass API key requirements and ignore ban lists to...

PT-2026-94042

Name of the Vulnerable Software and Affected Versions Shlink versions prior to 5.1.7 Description Failure to enforce API key role restrictions occurs when issuing Mercure subscription tokens, which allows restricted keys to subscribe to all topics. This enables attackers possessing author-only or...

CVE-2026-91935

Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrary hosts. Attackers with chatflows:create or chatflows:update permissions can exfiltrate LLM provider API keys by redirecting requests to cloud metadata...

CVE-2026-91935 Flowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model Nodes

Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrary hosts. Attackers with chatflows:create or chatflows:update permissions can exfiltrate LLM provider API keys by redirecting requests to cloud metadata...

CVE-2026-91935

Flowise before 3.1.4 contains a Server-Side Request Forgery (SSRF) vulnerability caused by missing validation of baseURL parameters in chat-model nodes . An authenticated user holding chatflows:create or chatflows:update permissions can redirect requests to arbitrary hosts, enabling exfiltration ...

EUVD-2026-78793

Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrary hosts. Attackers with chatflows:create or chatflows:update permissions can exfiltrate LLM provider API keys by redirecting requests to cloud metadata...