CVE-2026-19709 Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...

EUVD-2026-62291

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...

CVE-2026-19406

The Easy Appointments WordPress plugin before 4.0.1 exposes an appointment-listing REST endpoint without per-user scoping, letting contributor-level accounts read all site bookings including customer names, schedules, and statuses. Fix is to upgrade to version 4.0.1 or later. No in-the-wild explo...

CVE-2026-14826 Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including...

CVE-2026-14826

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 lacks per-object ownership checks on REST routes, allowing contributor-level users to read other users' quiz notification recipient addresses via IDOR. Exploitation details are not provided. Upgrade to QSM 11.2.4 to remediate.

EUVD-2026-62266

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including...

CVE-2026-55984

A flaw was found in Gitea. An authenticated attacker could exploit a null pointer dereference within the AddTime API. This can lead to a denial of service DoS, making the application unavailable to legitimate users...

GHSA-2QJ4-MMR9-4V2F vulnerabilities

Vulnerabilities for packages: celeborn, pinot, thingsboard, pinot-fips, seata, management-api-for-apache-cassandra-5.0, hadoop-fips, management-api-for-apache-cassandra-4.1, trino, management-api-for-apache-cassandra-4.0, tinkerpop, tez, apache-hop-fips...

CVE-2026-59902 vulnerabilities

Vulnerabilities for packages: celeborn, pinot, thingsboard, pinot-fips, seata, management-api-for-apache-cassandra-5.0, hadoop-fips, management-api-for-apache-cassandra-4.1, trino, management-api-for-apache-cassandra-4.0, tinkerpop, tez, apache-hop-fips...

GHSA-2QJ4-MMR9-4V2F vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-5.0, celeborn, tez, thingsboard, trino...

CVE-2026-59903 vulnerabilities

Vulnerabilities for packages: infinispan, spark, wildfly, neo4j, tez, thingsboard, druid, zipkin, apache-activemq-artemis, keycloak, kserve-modelmesh, trino, opensearch, management-api-for-apache-cassandra-5.0, celeborn, logstash, apache-pulsar, strimzi-kafka-operator, wavefront-proxy, flyway,...

PT-2026-78732

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user with a role possessing the rest properties get...

UBUNTU-CVE-2026-23937

The Zabbix API host.get action can be exploited by authenticated users...

PT-2026-78782

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 10.4 through 10.4.1 Description An unauthenticated user can retrieve information from Edge Processor pipeline configurations when the Edge Processor is enabled. This occurs because the Edge Processor service REST API...

PT-2026-78781

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user without admin or power roles can compromise system...

CVE-2026-23937

The Zabbix API host.get action can be exploited by authenticated users...

CVE-2026-74954

Information disclosure due to side-channel in the Storage: Cache API c...

UBUNTU-CVE-2026-74959

Mitigation bypass in the Storage: Cache API component. This vulnerabil...

PT-2026-78504

Name of the Vulnerable Software and Affected Versions Wazuh Manager versions 4.0.0 through 4.14.4 Description A low-privilege read-only API user with manager:read permission can retrieve the cluster key from the ossec.conf element via the 'GET /manager/configuration?raw=true' endpoint. An attacke...

PT-2026-78393

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.7 Description Insufficient enforcement of the CONFIGURATION EDIT permission on administrative API read endpoints allows any authenticated user to access sensitive administrative data. By utilizing a valid session...