CVE-2026-93504 SveltyCMS User Attribute Update Endpoint +server.ts access control

A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/...path/+server.ts of the component User Attribute Update Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The name of the patch i...

CVE-2026-90884 WP Recipe Maker <= 10.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' parameter in all versions up to, and including, 10.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acces...

CVE-2026-90884 WP Recipe Maker <= 10.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' parameter in all versions up to, and including, 10.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acces...

CVE-2026-90884

The WP Recipe Maker WordPress plugin (versions ≤ 10.8.1 ) is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the 'notes' parameter , accessed via the REST Preview Endpoint . The root cause is insufficient input sanitization and output escaping. An authenticated attacker with Cont...

grafana: Grafana Live: Denial of Service due to unbounded memory allocation via push endpoint

A flaw was found in Grafana Live. An authenticated user with access to the Grafana Live API can exploit the push endpoint by sending a large or streaming request body. This can lead to unbounded memory allocation, potentially causing out-of-memory conditions and resulting in a Denial of Service D...

grafana: Grafana: Denial of Service via unbounded memory allocation in plugin resources endpoint

A flaw was found in Grafana. An authenticated user can exploit a vulnerability in the plugin resources endpoint by sending a request that causes unbounded memory allocation. This occurs when the system attempts to read the entire request body into memory. Successful exploitation can lead to an...

CVE-2026-87966

The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and...

CVE-2026-87966 Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR

The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and...

EUVD-2026-82675

The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and...

CVE-2026-87966 Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR

The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and...

CVE-2026-82982

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and...

CVE-2026-82982

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and...

EUVD-2026-82496

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing ownership verification on /users/customers/ endpoint in all versions up to, and including, 2.4.4. This makes it possible for authenticated...

CVE-2026-93506: Server-Side Request Forgery (SSRF)

A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. This patch is called...

CVE-2026-82982: Undefined Security Weakness

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and...

PT-2026-95248

Name of the Vulnerable Software and Affected Versions Easy Appointments versions 4.0 through 4.0.2.1 Description The plugin fails to perform ownership or authorization checks on the unauthenticated appointment-reservation endpoint. This allows unauthenticated attackers to overwrite or delete...

PT-2026-95597

Name of the Vulnerable Software and Affected Versions Weaver E-cology affected versions not specified Description An unauthenticated SQL injection allows remote attackers to execute arbitrary SQL queries. This occurs when malicious input is submitted through the userIdentifiers GET parameter in t...

PT-2026-95364

Name of the Vulnerable Software and Affected Versions SveltyCMS version 0.0.6 Description Improper access controls exist within the User Attribute Update Endpoint, specifically affecting the file src/routes/api/...path/+server.ts. This flaw allows a remote attacker to manipulate the system due to...

PT-2026-95430

Name of the Vulnerable Software and Affected Versions multicluster-observability-addon affected versions not specified Description A misconfiguration in the underlying addon-framework library allows a remote attacker to access a debug endpoint without authentication. After establishing a basic...

PT-2026-95412

Name of the Vulnerable Software and Affected Versions ClipBucket versions prior to 5.5.3-182 Description Authenticated users can achieve remote code execution by uploading a PHP file containing valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile function in...