12680 matches found
CVE-2026-27345
The CVE-2026-27345 entry concerns the WordPress plugin “Taxi Booking Manager for WooCommerce” (versions
WordPress User Registration plugin <= 5.2.6 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ziming Zhang in WordPress Plugin User Registration versions = 5.2.6...
EUVD-2026-57820
OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants...
WordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by rajukani100 in WordPress Plugin InstaWP Connect versions = 0.1.3.7...
CVE-2026-14332
The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an...
CVE-2026-14213
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee provider is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data...
CVE-2026-18945
The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...
CVE-2026-13328
The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the...
CVE-2026-18945
The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...
CVE-2026-14213
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee provider is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data...
EUVD-2026-57728
The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...
EUVD-2026-57724
The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the...
EUVD-2026-57719
An incorrect authorization check in the v2 Alarm REST API in OpenNMS Meridian and Horizon allows a low-privileged authenticated user ROLEREST to acknowledge, escalate, or clear alarms recorded as an arbitrary username, and, when also assigned ROLEREADONLY, to modify alarm state despite the...
EUVD-2026-57634
Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — testfunc only checks ismycase, not ownership of kwargs'member'. Bypasses sharestatus; leaks embargoed vendor affected/not-affected + statement text cross-tenant...
PT-2026-71924
OpenChoreo is a complete, open-source developer platform for Kubernetes. From 1.2.0-rc.1 until 1.2.0, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter...
PT-2026-71544
Unauthenticated Broken Access Control in WPMobile.App = 11.77 versions...
PT-2026-71588
Unauthenticated Broken Access Control in Anti Spam and list cleaner AcyChecker = 2.0.0 versions...
PT-2026-71779
The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flow...