CVE-2026-76211

phpMyFAQ before 4.1.7 contains an authorization flaw in its admin API. The CONFIGURATION_EDIT permission is not properly enforced on read endpoints for LDAP , Elasticsearch , OpenSearch , and dashboard configuration. Any authenticated user with a valid session can call these endpoints and retriev...

EUVD-2026-62452

phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATIONEDIT permission on admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration, allowing any authenticated user to access sensitive administrative data. Attackers can retrieve LDAP server topology, bind...

CVE-2026-73394

Unauthenticated Broken Access Control in Stitch Express = 1.9.0 versions...

CVE-2026-73385

Unauthenticated Broken Access Control in Outranking Plugin Options = 1.1.3 versions...

CVE-2026-73363

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce 2.0.8 versions...

CVE-2026-73385 WordPress Outranking plugin Options plugin <= 1.1.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Outranking Plugin Options = 1.1.3 versions...

EUVD-2026-62386

Unauthenticated Broken Access Control in Outranking Plugin Options = 1.1.3 versions...

CVE-2026-73385

The WordPress Outranking Plugin Options plugin (versions ≤ 1.1.3) has an unauthenticated broken access control flaw (CVSS 7.5 HIGH), allowing remote attackers with no credentials to alter plugin settings and potentially inject malicious content. No patch version or exploit details are provided in...

CVE-2026-73385 WordPress Outranking plugin Options plugin <= 1.1.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Outranking Plugin Options = 1.1.3 versions...

EUVD-2026-62383

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce 2.0.8 versions...

CVE-2026-73363 WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce 2.0.8 versions...

CVE-2026-73363

CVE-2026-73363 is an unauthenticated Broken Access Control vulnerability in the WordPress plugin Taxi Booking Manager for WooCommerce (plugin slug: ecab-taxi-booking-manager ), affecting versions prior to 2.0.8 . The flaw allows a low-privileged user to perform unauthorized actions, resulting in ...

CVE-2026-73394 WordPress Stitch Express plugin <= 1.9.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Stitch Express = 1.9.0 versions...

EUVD-2026-62371

Unauthenticated Broken Access Control in Stitch Express = 1.9.0 versions...

CVE-2026-73394

The WordPress Stitch Express plugin (versions ≤ 1.9.0) has an unauthenticated broken access control flaw exploitable over the network with no credentials (CVSS 7.5, HIGH), allowing unauthorised integrity changes; no patch version or exploit details are provided in the documents.

WordPress Koji theme <= 2.2.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Theme Koji versions = 2.2.1...

WordPress Leyka plugin <= 3.32.3 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Jakub Herman in WordPress Plugin Leyka versions = 3.32.3...

WordPress Chaplin theme <= 2.6.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Theme Chaplin versions = 2.6.8...

PYSEC-2026-3703 vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

Impact Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes. Worst they could do is update the image or image tag. If that is not noted, another image is approved than the one actually under review Patches No Workarounds No...

WordPress Altair theme <= 5.2.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Altair versions = 5.2.2...