PT-2026-95157

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.8.5 Description The contribution request dispatcher in the endpoint 'web/html/contribuicao/controller/control.php' accepts attacker-controlled nomeClasse and metodo values without a complete allowlist. This allows...

CVE-2026-14319: Exposure of Sensitive Information to an Unauthorized Actor

The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details...