PT-2026-114420

Name of the Vulnerable Software and Affected Versions curl versions prior to 8.23.0-1.1 Description An ftp:// transfer configured with CURLUSESSL NONE may reuse a pooled FTP control connection previously upgraded with STARTTLS and authenticated via a client certificate. Because the subsequent...

PT-2026-113964

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise /api/folder/renameFolder.php authorizes an authenticated, non-folder-scoped, non-administrator with a valid CSRF token against the source folder but does not...

CVE-2026-104751: Missing Authorization

The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its stored SEO analysis data, allowing unauthenticated users to delete it...

CVE-2026-110844: Incorrect Authorization

n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool inline sub-workflows. Attackers can save workflows with Workflow Tool or Workflow Retriever inline definitions referenci...

PT-2026-113589

The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve personally...

CVE-2026-55383: Improper Authorization

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailableid without verifying mailabletype,...

CVE-2026-110467: Authorization Bypass Through User-Controlled Key

Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to view the peer review scores of any student...

CVE-2026-88927: Authorization Bypass Through User-Controlled Key

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may write to the album an upload is assigned to, allowing users with a subscriber-level account or above to place media into another user's private album and have it attributed to...

CVE-2026-110630: Incorrect Authorization

VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete...

CVE-2026-89072: Incorrect Authorization

Incorrect Authorization vulnerability in Progress MOVEit Transfer Client Certificates module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

PT-2026-113990

Missing Authorization vulnerability in Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push Notification for Post and BuddyPress: from n/a through...

CVE-2026-107319: Authorization Bypass Through User-Controlled Key

The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its authenticated AJAX actions, allowing any authenticated user, such as a Subscriber, to read arbitrary entries from its activity log, including other users' points balances and...

CVE-2026-110629: Missing Authorization

VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded...

CVE-2026-14851: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information PII and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised...

PT-2026-114064

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has node perm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotat...

CVE-2026-108066: Authorization Bypass Through User-Controlled Key

The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts the...

CVE-2026-102986: Authorization Bypass Through User-Controlled Key

Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/anchor/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a...

CVE-2026-70396: Incorrect Authorization

Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth application token without repository-write scope can therefore create organization-owned repositories ...

CVE-2026-71184: Incorrect Authorization

Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. Review comment and review approval or rejection events can consequently load workflow code from the fork hea...

PT-2026-114059

we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented out. Attackers can supply an mp id and guessable...