CVE-2026-88898 AppFlowy-Cloud 0.7.2 through 0.9.64 Missing Workspace Authorization on Bulk Publish Endpoint

AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to publish content into other tenants' namespaces. Attackers can write published views with attacker-controlled title, body and metadata int...

Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API

The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based shouldhidevalueforkey check which triggers on secret-suffixed key names like password / token / secret could not fire for JSON-decodable variable values. An authenticated UI/API user...

PYSEC-2026-3806 Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API

The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based shouldhidevalueforkey check which triggers on secret-suffixed key names like password / token / secret could not fire for JSON-decodable variable values. An authenticated UI/API user...

WordPress Bulk Password Reset plugin <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset vulnerability

Authenticated Subscriber+ Arbitrary Password Reset vulnerability discovered by Afan, moonge in WordPress Plugin Bulk Password Reset versions = 1.3.3...

CVE-2026-14873

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including...

CVE-2026-14873 Bulk Password Reset <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including...

CVE-2026-14873

The Bulk Password Reset plugin for WordPress is affected in all versions up to and including 1.3.3 by a privilege escalation vulnerability. The plugin fails to properly validate a user's identity before updating account details, allowing an authenticated attacker with subscriber-level access or a...

EUVD-2026-75241

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including...

PT-2026-89457

AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to publish content into other tenants' namespaces. Attackers can write published views with attacker-controlled title, body and metadata int...

CVE-2026-14873: Missing Authorization

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including...

CVE-2026-88898: Missing Authorization

AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to publish content into other tenants' namespaces. Attackers can write published views with attacker-controlled title, body and metadata int...

PT-2026-89280

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulk action parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it...

Exploit for Allocation of Resources Without Limits or Throttling in Redis

CVE-2021-32675 – Redis Pre-Allocation Denial of Service OOM...

PT-2026-89261

Name of the Vulnerable Software and Affected Versions Bulk Password Reset versions prior to 1.3.4 Description This issue allows authenticated attackers with subscriber-level access and above to perform privilege escalation via account takeover. The flaw exists because the plugin fails to properly...

Linux Distros Unpatched Vulnerability : CVE-2026-86091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools an...

EUVD-2026-71992

The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulkactions' function. This makes it possible for authenticated attackers, with...

CVE-2026-15550

The Ninja Forms – Save Progress WordPress plugin (versions ≤ 3.0.30) is affected by a missing authorization flaw rooted in the absence of capability checks and nonce verification within the bulk_actions function. Authenticated users holding subscriber-level or higher permissions can leverage this...

EUVD-2026-71778

ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traff...

PT-2026-86408

The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulk actions' function. This makes it possible for authenticated attackers, with...

CVE-2026-86091

ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traff...