CVE-2026-17023 Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth Callback

The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Goog...

CVE-2026-17023

Summary: CVE-2026-17023 affects the Salon Booking System WordPress plugin (≤ 10.30.33). The plugin does not perform capability checks or validate the OAuth state on the Google Calendar authorization callback, and this callback is also accessible to unauthenticated users. This allows an unauthenti...

EUVD-2026-54992

The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to res...

CVE-2026-18934

The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user owns or is allowed to edit the import job named in the request, allowing users with author-level access and above to permanently delete the posts created by another user's import job, reset its...

EUVD-2026-55020

The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data name, email, phone, address stored in form drafts...

CVE-2026-15237 Hotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid...

EUVD-2026-55017

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid...

EUVD-2026-55040

The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them...

PT-2026-69963

Name of the Vulnerable Software and Affected Versions Feast affected versions not specified Description An authorization bypass exists in the '/materialize' and '/materialize-incremental' endpoints. By sending a specially crafted request that omits the feature views field, an unauthenticated remo...

Linux Distros Unpatched Vulnerability : CVE-2026-19404

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check,...

PT-2026-69959

Name of the Vulnerable Software and Affected Versions Data Science Pipelines affected versions not specified Description An improper authorization issue exists in the setDefaultServiceAccount function. A restricted user or tenant can bypass authorization checks by specifying a more privileged...

Linux Distros Unpatched Vulnerability : CVE-2026-15970

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured wi...

CVE-2026-70395

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up. When managerelationship is used with onlookup: :relate on a belongsto...

CVE-2026-19362

A vulnerability has been found in lmammino oidc-authorizer 0.4.0. This issue affects the function parsetokenfromheader of the file src/parsetokenfromheader.rs of the component Authorization Header Parsing. The manipulation of the argument authorizationtoken leads to denial of service. Remote...

EUVD-2026-54933

A vulnerability has been found in lmammino oidc-authorizer 0.4.0. This issue affects the function parsetokenfromheader of the file src/parsetokenfromheader.rs of the component Authorization Header Parsing. The manipulation of the argument authorizationtoken leads to denial of service. Remote...

CVE-2026-19362

The CVE-2026-19362 affects lmammino oidc-authorizer 0.4.0. It concerns the function parse_token_from_header in src/parse_token_from_header.rs of the Authorization Header Parsing component, where manipulation of the authorization_token argument can cause a denial of service. Remote exploitation is...

CVE-2026-19350

A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is...

CVE-2026-19350

Dolibarr ERP TakePOS module vulnerability CVE-2026-19350 affects the function fail in htdocs/takepos/invoice.php. The issue enables manipulation that leads to missing authorization, with remote exploitation potential. A patch identified as 8992ce8704da947b6abe7b65a6fe59aed736bb81 is available; ap...

CVE-2026-19350 Dolibarr ERP TakePOS invoice.php fail authorization

A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is...

CVE-2026-19350 Dolibarr ERP TakePOS invoice.php fail authorization

A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is...