CVE-2026-24059 Gitea runner registration-token GET endpoint performs a write under a read-only token scope

The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...

CVE-2026-73349

Unauthenticated Broken Access Control in GiveWP 4.16.6 versions...

CVE-2026-73353

Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce 4.22.10 versions...

CVE-2026-73401

Unauthenticated Broken Access Control in InstaWP Connect = 0.1.3.7 versions...

CVE-2026-73403

Unauthenticated Broken Access Control in User Registration = 5.2.6 versions...

CVE-2026-66689

Unauthenticated Broken Access Control in Anti Spam and list cleaner AcyChecker = 2.0.0 versions...

CVE-2026-66691

Unauthenticated Broken Access Control in Nokri = 1.6.6 versions...

CVE-2026-66693

Subscriber Broken Access Control in Motors = 1.4.113 versions...

CVE-2026-66660

Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on = 2.5.1 versions...

CVE-2026-66469

Unauthenticated Broken Access Control in Arvow AI SEO Writer = 1.5.3 versions...

CVE-2026-66461

Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce = 1.0.5 versions...

CVE-2026-66464

Unauthenticated Broken Access Control in Internal Link Optimiser = 5.2.7 versions...

CVE-2026-66466

Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart = 2.1.1 versions...

CVE-2026-66459

Unauthenticated Broken Access Control in AI for SEO = 2.4.2 versions...

CVE-2026-66455

Subscriber Broken Access Control in ReactPress = 3.4.0 versions...

CVE-2026-66454

Unauthenticated Broken Access Control in WP Social Avatar = 1.5 versions...

CVE-2026-66441

Unauthenticated Broken Access Control in MultiVendorX = 5.0.10 versions...

CVE-2026-66431

Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce via CLINK = 1.0.7 versions...

CVE-2026-61984

Unauthenticated Broken Access Control in WPMobile.App = 11.77 versions...

CVE-2026-61978

Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter Piraeus Bank = 1.0.32 versions...