CVE-2026-82276 StarRocks Frontend REST Handlers Bypass the Base Class Authentication Gate

StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute directly instead of implementing executeWithoutPassword. Attackers can access six unauthenticated endpoints on the frontend HTTP port to disclose cluster topology, database...

CVE-2026-54745

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenticated server-side request forgery vulnerability through the /proxy/ route in frontend/server/proxy-middleware.ts. The...

WordPress User Frontend plugin < 4.3.10 - Editor+ PHP Object Injection vulnerability

Editor+ PHP Object Injection vulnerability discovered by Hijun Kim in WordPress Plugin WP User Frontend versions 4.3.10...

CVE-2026-14558

The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...

CVE-2026-14567

The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators...

CVE-2026-14567

The User Frontend WordPress plugin, in versions before 4.3.10 , is vulnerable to an information disclosure flaw because it fails to restrict access to its user directory search endpoint . This allows unauthenticated attackers to retrieve the email addresses and phone numbers of all registered use...

EUVD-2026-67568

The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators...

CVE-2026-14567 WP User Frontend < 4.3.10 - Unauthenticated User Email and Phone Disclosure via User Directory

The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators...

CVE-2026-14567 WP User Frontend < 4.3.10 - Unauthenticated User Email and Phone Disclosure via User Directory

The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators...

WordPress User Frontend plugin < 4.3.10 - Unauthenticated User Email and Phone Disclosure vulnerability

Unauthenticated User Email and Phone Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin WP User Frontend versions 4.3.10...

EUVD-2026-67567

The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...

CVE-2026-14558

The User Frontend WordPress plugin, in versions before 4.3.10 , is vulnerable to a PHP Object Injection flaw. The root cause is the failure to properly validate field type definitions, leading to the deserialization of user-controlled post metadata during the rendering of submitted posts. This vu...

CVE-2026-14558 WP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form Builder

The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...

CVE-2026-14558 WP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form Builder

The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...

PT-2026-82874

The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators...

PT-2026-82873

The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...

CVE-2026-54745: Improper Access Control

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenticated server-side request forgery vulnerability through the /proxy/ route in frontend/server/proxy-middleware.ts. The...

CVE-2026-14567: Exposure of Sensitive Information to an Unauthorized Actor

The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators...

PT-2026-83299

StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute directly instead of implementing executeWithoutPassword. Attackers can access six unauthenticated endpoints on the frontend HTTP port to disclose cluster topology, database...

CVE-2026-14558: Deserialization of Untrusted Data

The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code...