WordPress Wired Impact Volunteer Management plugin < 2.8.2 - Subscriber+ Arbitrary RSVP Removal via wivm_remove_rsvp vulnerability

Subscriber+ Arbitrary RSVP Removal via wivmremoversvp vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Wired Impact Volunteer Management versions 2.8.2...

WordPress EPROLO Dropshipping plugin <= 2.4.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by hivesec in WordPress Plugin EPROLO Dropshipping versions = 2.4.2...

WordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Homlisti versions = 3.1.2...

EUVD-2026-62916

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use crafted report notification data to cause Splunk Secure Gateway to send a request to...

EUVD-2026-63115

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete Splunk Processing Language version 2 SPL2 modules belonging to other users through the data management orchestrator interface. The vulnerability does not affect Splunk...

EUVD-2026-63108

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read sensitive Security Assertion Markup Language setup and instance settings information...

EUVD-2025-210743

IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to read or modify another user's command history due to an externally controlled filename...

PT-2026-78974

Name of the Vulnerable Software and Affected Versions Homlisti versions prior to 3.1.3 Description Broken access control exists for subscribers, allowing unauthorized access or actions. Recommendations Update to a version newer than 3.1.2...

PT-2026-80254

Summary The django-cms frontend-editing structure endpoint GET //admin/cms/placeholder/object//structure// did not perform an object-level authorization check for non-PageContent objects. Any authenticated, active staff user could request the structure endpoint for a frontend-editable object a...

PT-2026-78992

Name of the Vulnerable Software and Affected Versions EPROLO Dropshipping versions prior to 2.4.3 Description Broken access control allows unauthenticated users to gain unauthorized access to restricted areas or functions of the system. Recommendations Update to a version newer than 2.4.2...

PT-2026-78993

Name of the Vulnerable Software and Affected Versions Koji versions prior to 2.2.2 Description An unauthenticated broken access control issue exists, allowing users to bypass authorization mechanisms without providing valid credentials. Recommendations Update to a version newer than 2.2.1...

CVE-2026-74020: Missing Authorization

Unauthenticated Broken Access Control in Koji = 2.2.1 versions...

PT-2026-80213

Impact The internal Pages admin API incorrectly returns page fields without access control when they are declared in api fields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of api fields on the base page model title, slug, s...

PT-2026-78978

Name of the Vulnerable Software and Affected Versions Leyka versions prior to 3.32.4 Description Broken authentication exists for subscribers, allowing potential unauthorized access to accounts. Recommendations Update to a version newer than 3.32.3...

PT-2026-79261

Name of the Vulnerable Software and Affected Versions EverShop versions prior to 2.2.1 Description An authorization flaw exists in the customer update route. The route is incorrectly configured as public, allowing the admin authentication middleware to bypass caller verification. Additionally, th...

PT-2026-79090

Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.8 Description The copy plugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The copy plugin to clipboard and copy placeholder to clipboard paths accept source placeholder...

CVE-2026-74019: Missing Authorization

Unauthenticated Broken Access Control in EPROLO Dropshipping = 2.4.2 versions...

CVE-2026-66647: Missing Authorization

Subscriber Broken Access Control in Homlisti = 3.1.2 versions...

PT-2026-80240

Impact The only authorization gate on the duplicate flow is PageAdmin.has add permission, which checks user can add pageuser, site / user can add subpage... — i.e. “may this user create a page at all”. Nothing checks the user’s relationship to the page being copied: - cms/admin/forms.py —...

PT-2026-80221

Summary The clipboard copy paths of the copy plugins admin endpoint validate only the target the user's own clipboard and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the secret content. Details In...