CVE-2026-59242

Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserializevalue without the checkforbiddenxcomkeys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow. classes ...

EUVD-2026-57312

Apache Airflow's XCom GET /api/v2/.../xcomEntries/key?deserialize=true endpoint passed a string-literal payload through BaseXCom.deserializevalue without the checkforbiddenxcomkeys guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary airflow. classes ...

CVE-2026-68969 Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit log in cleartext

Apache Airflow wrote Variable values and Connection extra contents to the audit log in cleartext when they were submitted through the bulk endpoints PATCH /api/v2/variables and PATCH /api/v2/connections. The audit-log masking recognised only top-level request fields, and a bulk request nests its...

CVE-2026-73432

CVE-2026-73432 affects Vulnerability-Lookup: SSRF via remote-instance synchronization where addresses were only validated for syntax before storage and later dereferenced with requests.get(), following redirects without network-boundary checks. An authenticated admin (admin:access) can configure ...

CVE-2026-73405

An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events SSE streams through the /pubsub/subscribe/ endpoint. The tokenrequired decorator used by the Pub/Sub interface authenticated requests solely by matching the...

grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads

A flaw in Grafana's API endpoints allows remote attackers to send excessively large request bodies without authentication. This exhausts server memory, resulting in a complete denial of service DoS...

CVE-2026-18943

The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post and term metadata, including data belonging to administrators...

EUVD-2026-57106

The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation a...

CVE-2026-18943

The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post and term metadata, including data belonging to administrators...

EUVD-2026-57103

The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post and term metadata, including data belonging to administrators...

CVE-2026-18943 WPC Admin Columns < 2.3.4 - Subscriber+ Arbitrary User/Post/Term Meta Disclosure

The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post and term metadata, including data belonging to administrators...

CVE-2026-19052

The CVE concerns the ProSolution WP Client WordPress plugin

CVE-2026-18943

The vulnerability CVE-2026-18943 affects the WPC Admin Columns WordPress plugin before version 2.3.4. One of the plugin’s AJAX actions lacks proper authorization checks, enabling users with a role as low as subscriber to read arbitrary user, post, and term metadata, including data belonging to ad...

CVE-2026-19052 ProSolution WP Client < 2.0.9 - Subscriber+ proSol_ajaxTablesync and proSol_ajaxClearlog Calls

The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subscriber, to trigger an administrative data synchronisation a...

EUVD-2026-57095

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server,...

CVE-2026-14859

The CVE-2026-14859 affects WP Crowdfunding

CVE-2026-14859 WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Creation via Missing Authorization

The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions, allowing any authenticated users such as Subscribers to create crowdfunding campaign posts despite not being granted that permission...

CVE-2026-13613 KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint

The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection...

CVE-2026-13171

The CVE-2026-13171 entry concerns the Eventin WordPress plugin (before 4.1.20). The vulnerability is a missing authorization check on the waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records. Imp...

PT-2026-71246

SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allowing anonymous readers to retrieve block-level content of password-protected documents. Attackers can call these endpoints without supplying a password to read protected document...