CVE-2026-107907

The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce it verifies is tied only to a static action rather than to the targeted object, allowing any authenticated user with a...

PT-2026-122499

The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce it verifies is tied only to a static action rather than to the targeted object, allowing any authenticated user with a...

CVE-2026-57121

The praisonai-platform package (versions 0.1.4 to before 0.1.5) is vulnerable to an improper authorization issue in its Platform API. Specifically, six content DELETE endpoints for projects, agents, issues, labels, issue dependencies, and issue-label attachments fail to perform ownership or role ...

CVE-2026-57121 PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API

PraisonAI is a multi-agent teams system. From version 0.1.4 to before version 0.1.5 in praisonai-platform, a workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members...

CVE-2026-57121 PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API

PraisonAI is a multi-agent teams system. From version 0.1.4 to before version 0.1.5 in praisonai-platform, a workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members...

CVE-2026-87942

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions: from 0.0.0 to 1.0.88...

EUVD-2026-97891

Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks. Authenticated non-admin users can send PUT or DELETE requests to /api/link,story,chest,album/id with numeric IDs to overwrite or delete othe...

CVE-2026-65459

Unauthenticated Arbitrary Content Deletion in Forminator = 1.57.3 versions...

CVE-2026-65459

The Forminator WordPress plugin (versions

EUVD-2026-96513

Unauthenticated Arbitrary Content Deletion in Forminator = 1.57.3 versions...

CVE-2026-65459 WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability

Unauthenticated Arbitrary Content Deletion in Forminator = 1.57.3 versions...

CVE-2026-65459 WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability

Unauthenticated Arbitrary Content Deletion in Forminator = 1.57.3 versions...

CVE-2026-65459: Missing Authorization

Unauthenticated Arbitrary Content Deletion in Forminator = 1.57.3 versions...

PT-2026-109845

Unauthenticated Arbitrary Content Deletion in Forminator = 1.57.3 versions...

WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability

Arbitrary Content Deletion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Forminator versions = 1.57.3...

CVE-2026-105244 Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content

Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whos...

CVE-2026-105244 Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content

Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whos...

CVE-2026-101923

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30. This is due to the plugin storing attacker-controlled post IDs from the wcprimageuploadid parameter of a public review submission into the review's...

CVE-2026-101923

The Photo Reviews for WooCommerce plugin for WordPress (versions up to and including 1.2.30 ) is vulnerable to Arbitrary Content Deletion due to a missing authorization check. The plugin saves attacker-controlled post IDs from the wcpr_image_upload_id parameter of a public review submission into ...

CVE-2026-101923 Photo Reviews for WooCommerce <= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr_image_upload_id' Parameter

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30. This is due to the plugin storing attacker-controlled post IDs from the wcprimageuploadid parameter of a public review submission into the review's...