CVE-2026-28153 WordPress Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin <= 1.7.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Notification Master Real-Time WordPress Notifications With Email, SMS, Webhooks & More = 1.7.1 versions...

EUVD-2026-64792

Unauthenticated Broken Access Control in Notification Master Real-Time WordPress Notifications With Email, SMS, Webhooks & More = 1.7.1 versions...

CVE-2026-78272

CVE-2026-78272 is a Subscriber Broken Access Control vulnerability in the Fluent Support Pro WordPress plugin, affecting versions

CVE-2026-78272 WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Fluent Support Pro = 2.3.1 versions...

CVE-2026-78272 WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Fluent Support Pro = 2.3.1 versions...

EUVD-2026-64836

Subscriber Broken Access Control in Fluent Support Pro = 2.3.1 versions...

CVE-2026-78258 WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Booking and Rental Manager = 2.7.5 versions...

CVE-2026-78258

CVE-2026-78258 is an unauthenticated Broken Access Control vulnerability in the Booking and Rental Manager WordPress plugin (for WooCommerce), affecting versions 2.7.5 and earlier . The flaw allows remote attackers to access data without proper authorization, resulting in a low confidentiality im...

EUVD-2026-64833

Unauthenticated Broken Access Control in Booking and Rental Manager = 2.7.5 versions...

CVE-2026-78258 WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Booking and Rental Manager = 2.7.5 versions...

CVE-2026-78291 WordPress RepairBuddy plugin <= 4.1223 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in RepairBuddy = 4.1223 versions...

CVE-2026-78291 WordPress RepairBuddy plugin <= 4.1223 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in RepairBuddy = 4.1223 versions...

EUVD-2026-64829

Unauthenticated Broken Access Control in RepairBuddy = 4.1223 versions...

CVE-2026-78291

CVE-2026-78291 is an unauthenticated Broken Access Control vulnerability in the WordPress plugin RepairBuddy (also referenced as Computer Repair Shop ), affecting versions 4.1223 and earlier . Discovered by Supakiad S. (m3ez) via Patchstack, the flaw allows a remote, unauthenticated attacker to m...

WordPress RepairBuddy plugin <= 4.1223 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Supakiad S. m3ez in WordPress Plugin RepairBuddy versions = 4.1223...

WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Support Pro versions = 2.3.1...

WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Bao - BlueRock in WordPress Plugin Booking and Rental Manager versions = 2.7.5...

WordPress ProLancer Element plugin <= 1.4.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Jamaal ahmed in WordPress Plugin ProLancer Element versions = 1.4.8...

CVE-2026-19200

Velociraptor 's verify() VQL function suffers from an implementation fault that causes it to use the global artifact repository instead of a scoped one. This allows a user with only the NOTEBOOK_EDIT permission (e.g., an analyst role) to overwrite existing live built-in artifacts without the perm...

CVE-2026-78204

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...