CVE-2026-82633 Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint

Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/id/groups with arbitrary user identifiers to access group name...

CVE-2026-82633 Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint

Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/id/groups with arbitrary user identifiers to access group name...

CVE-2026-79483

creationtimestamp| type| source ---|---|--- 2026-08-30 11:00:06+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/100341 2026-08-31 00:00:26+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/100341 2026-09-02 01:00:18+00:00| seen|...

CVE-2026-14835: Improper Neutralization of Input During Web Page Generation

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfilteredhtml capability, allowing users with contributor-level access a...

PT-2026-83505

Cleartext Storage of Sensitive Information vulnerability in ash-project ash paper trail allows an attacker with read access to the generated version resource to recover sensitive values nested inside embedded resources, unions, or lists. sensitive attributes :redact and :ignore only act on the...

CVE-2026-16600: Server-Side Request Forgery (SSRF)

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external...

CVE-2026-82265

Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensitive information. Attackers can read environment variables, bean configurations, and storage credentials via actuator endpoints, or modify...

CVE-2026-55066

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/project/views/view/buckets/bucket/tasks accepts a body supplied taskid but TaskBucket.CanUpdate in pkg/models/kanbantaskbucket.go authorizes only the project, view, and bucket from the URL...

Snipe-IT has missing object-level authorization in Kits API

Impact The API endpoint for adding a license to a predefined kit POST /api/v1/kits/kitid/licenses only checks whether the caller can edit kits, but does not perform object-level authorization on the referenced license itself. Because of this, a low-privilege user with only predefined-kit...

EUVD-2026-67838

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and TimeApi.setTime. An authenticated low-privilege user can read...

CVE-2026-82283 VoltAgent Memory API Handlers Missing Ownership Checks

VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying caller-controlled identifiers to memory endpoints...

EUVD-2026-67796

Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensitive information. Attackers can read environment variables, bean configurations, and storage credentials via actuator endpoints, or modify...

CVE-2026-81761

WpEvently is a WordPress plugin affected by a Broken Access Control vulnerability in versions ≤ 5.5.0 . The flaw allows a Subscriber -level user to perform actions beyond their intended permissions, resulting in a low confidentiality impact with no integrity or availability loss. The CVSS 3.1 sco...

EUVD-2026-67731

Contributor Broken Access Control in WpEvently = 5.5.0 versions...

CVE-2026-82227 WordPress WPBulky plugin <= 1.2.2 - SQL Injection vulnerability

Contributor SQL Injection in WPBulky = 1.2.2 versions...

EUVD-2026-67727

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

EUVD-2026-67726

Contributor SQL Injection in WPBulky = 1.2.2 versions...

WordPress CMP plugin < 4.1.18 - Editor+ Privilege Escalation vulnerability

Editor+ Privilege Escalation vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin CMP – Coming Soon & Maintenance versions 4.1.18...

CVE-2026-3423 Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description

The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-82243

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs without SSRF validation. Attackers can exploit this to leak internal CouchDB credentials by making requests to...