CVE-2026-82225 WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in RegistrationMagic = 6.0.9.8 versions...

CVE-2026-82225 WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in RegistrationMagic = 6.0.9.8 versions...

CVE-2026-81762

CVE-2026-81762 is a Broken Access Control vulnerability in the Booking and Rental Manager WordPress plugin (for WooCommerce), affecting versions 2.7.6 and earlier . The flaw allows users with the Subscriber role to perform actions they should not be permitted to, resulting in a High integrity imp...

EUVD-2026-68786

Subscriber Broken Access Control in Booking and Rental Manager = 2.7.6 versions...

CVE-2026-81762 WordPress Booking and Rental Manager plugin <= 2.7.6 - Broken Access Control vulnerability

Subscriber Broken Access Control in Booking and Rental Manager = 2.7.6 versions...

CVE-2026-81762 WordPress Booking and Rental Manager plugin <= 2.7.6 - Broken Access Control vulnerability

Subscriber Broken Access Control in Booking and Rental Manager = 2.7.6 versions...

CVE-2026-81758 WordPress OwnerRez API plugin <= 1.2.6 - Broken Access Control vulnerability

Subscriber Broken Access Control in OwnerRez API = 1.2.6 versions...

CVE-2026-81758 WordPress OwnerRez API plugin <= 1.2.6 - Broken Access Control vulnerability

Subscriber Broken Access Control in OwnerRez API = 1.2.6 versions...

CVE-2026-81758

CVE-2026-81758 is a Broken Access Control vulnerability in the WordPress plugin OwnerRez API , affecting versions ≤ 1.2.6 . The flaw allows users with the Subscriber role to perform actions they should not be authorized for, as discovered by JunHee CHO via PatchStack. The CNA-assigned CVSS 3.1 sc...

EUVD-2026-68785

Subscriber Broken Access Control in OwnerRez API = 1.2.6 versions...

EUVD-2026-68781

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81296 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81296

CVE-2026-81296 affects the WordPress plugin Fluent Forms Pro Add On Pack (versions

CVE-2026-81296 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

EUVD-2026-68769

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/updateexchange.php loads the first Fixer/API Layer credential globally instead of loading the credential for the authenticated user. As a result, a normal authenticated user without...

CVE-2026-50198 Wallos: Cross-user subscription cost inference via replacement_subscription_id

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription and set replacementsubscriptionid to a subscription ID belonging to another user. The write is accepted, and later the stats logic...

CVE-2026-53508

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false library: openapi3.Loader.IsExternalRefsAllowed = false when loading a spec from a git revision the...

EUVD-2026-68747

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module::settingsForm allows to view not change super admin-restricted module settings and leak the full module entity. Exploitation of...

CVE-2026-53552 Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act on it without checking that the...

CVE-2026-79750

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.30, MCPHub scopes non-admin users to servers they own list views and config edits enforce ownership, but the...