CVE-2026-61826 Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery

Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the apinsplex namespace in bazarr/api/plex/oauth.py omits @authenticate on its Resource handlers, while normal APIs require an API key and no global authentication hook compensates. Anonymous callers can invoke POST...

WordPress Patreon WordPress plugin < 1.10.0 - Patreon Integration Takeover vulnerability

Patreon Integration Takeover vulnerability discovered by JunHee CHO in WordPress Plugin Patreon WordPress versions 1.10.0...

CVE-2026-18346 TikTok <= 1.4.1 - Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth_code' Parameter

The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the merchant's stor...

CVE-2026-18346 TikTok <= 1.4.1 - Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth_code' Parameter

The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the merchant's stor...

WordPress TikTok plugin <= 1.4.1 - Missing Authorization to Unauthenticated TikTok Integration Takeover vulnerability

Missing Authorization to Unauthenticated TikTok Integration Takeover vulnerability discovered by Hillary Mutai in WordPress Plugin TikTok versions = 1.4.1...