PT-2026-94177

Name of the Vulnerable Software and Affected Versions Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin versions prior to 5.1.1 Description An issue exists in the message deletion AJAX action where the software fails to verify user capabilities and only checks f...

CVE-2026-53557: Improper Neutralization of Special Elements used in an SQL Command

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...

CVE-2026-87829: Authorization Bypass Through User-Controlled Key

The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...

CVE-2026-52851: Improper Neutralization of Special Elements used in an SQL Command

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an object usable in a permission pair can submit DELETE /api/permissions with an extra attacker-controlled JSON key. PermissionLinkedHashMap in...

PT-2026-94193

Name of the Vulnerable Software and Affected Versions Checkout Field Manager Checkout Manager for WooCommerce WordPress versions prior to 7.9.7 Description An issue exists where the software fails to properly validate the ownership of an attachment before deletion. This allows any authenticated...

CVE-2026-54643: Missing Authorization

CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of orderid and delete-note parameters before deleting records from CubeCartordernotes, without requiring CCPERMDELETE for orders. An authenticated...

CVE-2026-90923: Incorrect Authorization

The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...

CVE-2026-92894: Incorrect Authorization

A flaw was found in the foremanansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by ID without verifying it belongs to an AnsibleVariable the caller is authorized to edit. An authenticated user with the editansiblevariables permission can dele...

PT-2026-94205

Name of the Vulnerable Software and Affected Versions foreman ansible plugin affected versions not specified Description A flaw exists in the Ansible override values API of the foreman ansible plugin. The destroy action resolves the target LookupValue record by ID but fails to verify if the recor...

CVE-2026-54446: Missing Authentication for Critical Function

NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.6, network-reachable HTTP transport requests to /mcp that omit x-netlicensing-api-key, Authorization: Bearer, and the apikey...

PT-2026-94891

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the hfsplus module where the hfsplus delete cat function fails to validate a thread record before rebuilding a delete key. When the last open reference to an unlinked...

CVE-2026-92753

PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts API endpoints that lack ownership filtering. Authenticated attackers can read platform event history, delete arbitrary events, and modify alerts belonging to other users...

EUVD-2026-81046

Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/id endpoint, allowing users with read access to delete access control relationships. Attackers can revoke the owner's grant and permanently lock legitimate owners out of objects...

CVE-2026-92752 metasfresh Unauthorized Access via Document Attachments and Comments Endpoints

metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing record-level permissions. Attackers can enumerate sequential document identifiers to read, replace, and delete attachments and comments on records their role...

CVE-2026-92469

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center module DELETE /files/id endpoint that performs no ownership validation. Authenticated attackers can enumerate file identifiers via GET /files and delete arbitrary users' files and metada...

CVE-2026-92469 microservices-platform through 6.0.0 Arbitrary File Deletion via Missing Ownership Check

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center module DELETE /files/id endpoint that performs no ownership validation. Authenticated attackers can enumerate file identifiers via GET /files and delete arbitrary users' files and metada...

CVE-2026-92469 microservices-platform through 6.0.0 Arbitrary File Deletion via Missing Ownership Check

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center module DELETE /files/id endpoint that performs no ownership validation. Authenticated attackers can enumerate file identifiers via GET /files and delete arbitrary users' files and metada...

EUVD-2026-80707

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center module DELETE /files/id endpoint that performs no ownership validation. Authenticated attackers can enumerate file identifiers via GET /files and delete arbitrary users' files and metada...

CVE-2026-92469

CVE-2026-92469 affects zlt2000 microservices-platform through 6.0.0 , specifically the file-center module . The DELETE /files/{id} endpoint performs no ownership validation, allowing any authenticated attacker to enumerate file identifiers via GET /files and subsequently delete other users' files...

CVE-2026-92469 microservices-platform through 6.0.0 Arbitrary File Deletion via Missing Ownership Check

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center module DELETE /files/id endpoint that performs no ownership validation. Authenticated attackers can enumerate file identifiers via GET /files and delete arbitrary users' files and metada...