CVE-2026-17018

The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata including that of...

CVE-2026-14206

The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data name, email, phone, address stored in form drafts...

EUVD-2026-55020

The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data name, email, phone, address stored in form drafts...

CVE-2026-15237 Hotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid...

EUVD-2026-55040

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them...

CVE-2026-18357

The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as billing names, order IDs and statuse...

EUVD-2026-54741

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users...

CVE-2026-16595 WP Directory Kit < 1.5.5 - Subscriber+ User and Unpublished Listing Disclosure

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users...

CVE-2026-16594

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP Directory Kit WordPress plugin before 1.5.5 settings including sensitive API keys and...

CVE-2026-16590

CVE-2026-16590 affects the WP Directory Kit WordPress plugin, version prior to 1.5.5. The vulnerability stems from missing authorization or nonce checks on an authenticated AJAX action, enabling any authenticated user (e.g., a Subscriber) to retrieve stored contact messages and associated user da...

CVE-2026-16589

The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks, allowing any authenticated user such as a Subscriber to perform SQL injection...

CVE-2026-16041

The CVE-2026-16041 entry concerns the MStore API WordPress plugin prior to version 4.21.0. The REST endpoint used for creating product reviews lacks authorization and purchase-ownership checks, allowing an unauthenticated attacker to submit WooCommerce product reviews with arbitrary reviewer name...

EUVD-2026-54322

Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-67621 Flowise 3.1.4 Missing Authorization on Document Store Mutation Endpoints

Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert...

Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entries

Impact An authenticated Control Panel user could view content from entries they don't have permission to view, including entry content and custom field values, from any collection and including unpublished entries. No data could be modified. Patches This has been fixed in 5.74.1 and 6.24.0...

Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence

Impact An authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belongs to an existing user, without having permission to view users. The endpoint only exposed user existence, not any of its data. Patches This has been...

CVE-2026-64664 Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belonged to an existing user, without having permission to view...

EUVD-2026-53386

Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning...

CVE-2026-17613

Penpot’s ::import-binfile RPC command is reported as lacking authorization on the optional file-id parameter. The vulnerability allows any authenticated user to overwrite arbitrary files on the target server and subscribe to WebSocket events, which can enable full data exfiltration and data poiso...

EUVD-2026-53347

IoTSharp BlobStorageController.cs lacks the Authorize attribute applied to every other controller in the application DevicesController, CustomersController, TenantsController, etc., and no global authorization FallbackPolicy is configured in Startup.cs, leaving its...