CVE-2026-86842: Missing Authorization

The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be...

CVE-2026-84098: Incorrect Authorization

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging...

PT-2026-105057

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, is authorized/2 uses is authorized monitor for all methods. DELETE resets rabbit core metrics:reset auth attempt metrics. Impact is cosmetic counters only, no log erasure, but inconsistent with rabbit mgmt w...

PT-2026-97557

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 4.1.13 RabbitMQ versions prior to 4.2.7 RabbitMQ versions prior to 4.3.0 Description An issue exists where the is authorized/2 function uses is authorized monitor for all methods. This allows a user with the monitori...

CVE-2026-95814

Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization ciphers. Attackers with revoked or pending membership can...

CVE-2026-63104

Kaneo versions 2.3.12 before 2.12.2 are vulnerable to a missing authorization flaw in the bulk task endpoint . While the system verifies workspace membership, it fails to invoke the role-based permission checks required for other task endpoints. Authenticated workspace members with viewer or memb...

EUVD-2026-84813

Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks...

CVE-2026-63104 Kaneo 2.3.12 < 2.12.2 Missing Authorization via Bulk Task Endpoint

Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks...

PT-2026-96663

Name of the Vulnerable Software and Affected Versions Tutor LMS – eLearning and online course solution plugin for WordPress versions prior to 4.0.8 Description An Insecure Direct Object Reference IDOR exists via the tutor quiz builder save AJAX action. The issue occurs because the system fails to...

PT-2026-96822

Name of the Vulnerable Software and Affected Versions Novu versions prior to 3.18.0 Description Novu provides an API for sending notifications through multiple channels. Certain integration mutation use cases fail to consistently enforce the environmentId when looking up an integration by...

PT-2026-96819

Name of the Vulnerable Software and Affected Versions Aureus ERP versions prior to 1.5.0 Description The software fails to scope message lookups to the current record within the ChatterPanel. This allows authenticated users to access arbitrary messages by submitting sequential message IDs. An...

PT-2026-96657

Name of the Vulnerable Software and Affected Versions PixelPlay versions prior to 1.0.3 Description The PixelPlay plugin for WordPress contains a flaw where authorization checks are missing, allowing unauthenticated attackers to delete API keys configured by site administrators. This is achieved ...

PT-2026-96659

Name of the Vulnerable Software and Affected Versions Custom Field Template versions prior to 2.7.9 Description The plugin contains an Insecure Direct Object Reference IDOR flaw, which occurs when an application provides direct access to objects based on user-supplied input. The issue exists in t...

PT-2026-96645

Name of the Vulnerable Software and Affected Versions Give Tributes versions prior to 2.3.2 Description The Give Tributes plugin for WordPress is susceptible to PHP Object Injection through the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. The...

CVE-2026-77243: Missing Authorization

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, ENABLEDTOOLS and TOOLSETS are applied when tools are listed but are not rechecked when a tools/call request is dispatched. A client that knows a hidden tool name can directly invoke...

CVE-2026-12995: Authorization Bypass Through User-Controlled Key

The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.8 via the editmetavalue due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access...

The vulnerability of the application software interface of the Traccar GPS system allows a violator to disclose protected information.

The vulnerability of the Traccar GPS system’s application programming interface is related to the lack of measures taken to protect the SQL query structure when processing an HTTP DELETE /api/permissions request. Exploiting this vulnerability can allow a remote attacker to disclose sensitive...

PT-2026-97055

Name of the Vulnerable Software and Affected Versions Vaultwarden versions prior to 1.37.4 Description Organization membership status validation is omitted from three cipher access-restriction queries. This allows members with revoked or not-yet-confirmed status to maintain read, write, delete, a...

CVE-2026-94496

jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and...

CVE-2026-94496 jshERP through 3.6 Privilege Escalation via Role Management

jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and...