CVE-2026-18777

The TrueBooker WordPress plugin (versions before 1.2.7 ) is vulnerable to an unauthenticated arbitrary appointment status change due to improper authorization checks in an AJAX action (specifically the update_appointment_status functionality). An unauthenticated attacker can exploit this flaw to ...

EUVD-2026-62274

The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on two of its AJAX actions, allowing users with at least the Subscriber role to read the titles of private and draft posts by ID and to enumerate stored post-meta key names...

CVE-2026-16979 SmartCrawl < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration

The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on two of its AJAX actions, allowing users with at least the Subscriber role to read the titles of private and draft posts by ID and to enumerate stored post-meta key names...

EUVD-2026-62267

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification...

EUVD-2026-62266

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including...

EUVD-2026-62262

The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, allowing any vendor to modify or permanently delete reviews belonging to other vendors' stores...

EUVD-2026-62261

The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users...

EUVD-2026-62260

The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts...

EUVD-2026-62258

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including...

EUVD-2026-62206

This High severity BASM Broken Authentication & Session Management vulnerability known as CVE-2026-21582 was introduced in version 7.2.1 of Crowd Data Center. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 8.8, allows an unauthenticated attacker to perfor...

CVE-2026-76878: Function Call With Incorrect Variable or Reference as Argument

In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the allprojects query parameter is set to false. The API checks for the presence of the allprojects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key a...

CVE-2026-18937: Improper Control of Generation of Code

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic non-block ...

PT-2026-78299

Name of the Vulnerable Software and Affected Versions Broken Link Checker versions prior to 2.4.12 Description On sites using plain permalinks, the plugin fails to limit the query variables accepted from user input. This allows unauthenticated users to overwrite arbitrary PHP global variables and...

PT-2026-78825

In Splunk AI Toolkit versions below 6.0.1, a user who does not hold the "admin" or "power" Splunk roles could delete the experiment history of another user without permission through the Representational State Transfer REST API. The vulnerability is possible because Splunk AI Toolkit deletes...

PT-2026-79951

The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flow...

CVE-2026-73363: Missing Authorization

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce 2.0.8 versions...

CVE-2026-73394: Missing Authorization

Unauthenticated Broken Access Control in Stitch Express = 1.9.0 versions...

PT-2026-78388

phpMyFAQ versions before 4.1.7 fail to validate active status in the PDF export endpoint, allowing unauthenticated attackers to retrieve draft FAQ metadata. Attackers can access the public PDF export route with sequential FAQ identifiers to obtain titles, solution IDs, author names, and last-upda...

CVE-2026-76238: Incorrect Authorization

stigmem versions before 0.9.0a12 contain a broken object level authorization vulnerability in the decay sweep endpoint that allows authenticated attackers with write credentials for one tenant to execute decay operations affecting all tenants. Attackers can submit POST requests to the decay sweep...

PT-2026-78274

The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts...