CVE-2026-96451

The Ultimate Member WordPress plugin, versions through 2.13.1 , is vulnerable to a Privilege Escalation issue due to an Authorization Bypass Through User-Controlled Key (CWE-639). This vulnerability allows an attacker to escalate privileges within the system. While specific exploit code and a dir...

EUVD-2026-92042

Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1...

CVE-2026-105120

OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessions of every realm. Attackers holding delegated RealmAdmin privileges can supply a queryFilter naming another realm to disclose usernames...

CVE-2026-105120

OpenAM before version 16.1.3 is affected by an authorization bypass vulnerability within the sessions REST endpoint query operation. This flaw allows users with delegated RealmAdmin privileges to bypass tenant boundaries by supplying a _queryFilter naming a different realm. Exploitation of this v...

EUVD-2026-92024

OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessions of every realm. Attackers holding delegated RealmAdmin privileges can supply a queryFilter naming another realm to disclose usernames...

CVE-2026-105120 OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint

OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessions of every realm. Attackers holding delegated RealmAdmin privileges can supply a queryFilter naming another realm to disclose usernames...

CVE-2026-105120 OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint

OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessions of every realm. Attackers holding delegated RealmAdmin privileges can supply a queryFilter naming another realm to disclose usernames...

CVE-2026-105120 OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint

OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessions of every realm. Attackers holding delegated RealmAdmin privileges can supply a queryFilter naming another realm to disclose usernames...

OPENSUSE-SU-2026:22019-1 Security update for rsyslog

This update for rsyslog fixes the following issue: - imdtls: fix permitted-peer authorization bypass bsc1281628...

CVE-2026-94505

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-11601

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possibl...

CVE-2026-11601 WPCafe <= 3.0.19 - Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Delete

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possibl...

EUVD-2026-91964

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possibl...

CVE-2026-11601

The WPCafe WordPress plugin (versions up to and including 3.0.19 ) is vulnerable to an authorization bypass because it fails to verify user permissions for specific actions. Specifically, the Email_Automation_Service_Provider::is_enable() method unconditionally returns true, leaving endpoints act...

CVE-2026-11601 WPCafe <= 3.0.19 - Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Delete

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possibl...

CVE-2026-94505 Nelio Content <= 4.5.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via 'id' Parameter

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-94505 Nelio Content <= 4.5.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via 'id' Parameter

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-94505

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 4.5.0 . The root cause is the plugin's failure to properly verify user permissions before performing actions. This allows authentica...

EUVD-2026-91961

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-91108

The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.10.41. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes i...