CVE-2026-93341: Missing Authorization

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketkingsendrefund AJAX action that allows authenticated attackers with subscriber-level access or higher to create refund requests against any order by supplying an arbitrary order ID. Attackers...

CVE-2026-93342: Missing Authorization

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketkingduplicateproduct AJAX action that allows authenticated attackers with subscriber-level access or higher to duplicate any vendor's product by supplying an arbitrary product ID. Attackers c...

CVE-2026-4123: Missing Authorization

The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missing capability check on the togglecache function which is hooked to the wpajaxtogglecache AJAX action. The function also lacks nonce...

CVE-2025-14487: Missing Authorization

The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configuration settings, including publishable...

CVE-2025-14484: Missing Authorization

The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys Pixabay, Unsplash, Pixels configured by site...

PT-2026-97083

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Improper authentication and missing authorization may allow a remote attacker to perform unauthorized actions. Recommendations At the moment...

CVE-2026-94384: Missing Authorization

Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda...

PT-2026-96664

Name of the Vulnerable Software and Affected Versions RW Elephant Rental Inventory versions prior to 2.3.14 Description The plugin contains a missing authorization flaw. The toggle cache function, which is linked to the wp ajax toggle cache AJAX action, does not perform a capability check or nonc...

PT-2026-96658

Name of the Vulnerable Software and Affected Versions Handily plugin for WordPress versions prior to 1.0.4 Description Missing authorization checks allow unauthenticated attackers to modify Stripe payment configuration settings. By manipulating payment settings parameters, an attacker can change...

CVE-2026-95683: Missing Authorization

In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constraints. Because MISP reports carry an...

PT-2026-97089

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Missing authorization in the software allows a remote authenticated attacker to perform unauthorized payment mutation actions. Recommendatio...

CVE-2026-77518

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP toolid in the same workspace can retrieve the hidden tool through the tool-detail route because it does not apply the per-resource authorization used by the...

CVE-2026-77516 MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path

MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role workspace member denied access to a tool by WorkspaceUserResourcePermission can still bind its identifier through toolids, skilltoolids, or mcptoolids and execute it through the agent or workflow...

CVE-2026-77516 MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path

MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role workspace member denied access to a tool by WorkspaceUserResourcePermission can still bind its identifier through toolids, skilltoolids, or mcptoolids and execute it through the agent or workflow...

CVE-2026-77518 MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflows

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP toolid in the same workspace can retrieve the hidden tool through the tool-detail route because it does not apply the per-resource authorization used by the...

WordPress PixelPlay plugin <= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary API Key Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary API Key Deletion vulnerability discovered by Phat RiO in WordPress Plugin PixelPlay versions = 1.0.2...

WordPress Image Buzz plugin <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary API Key Modification vulnerability

Missing Authorization to Unauthenticated Arbitrary API Key Modification vulnerability discovered by Phat RiO in WordPress Plugin Image Buzz versions = 1.0.3...

WordPress Handily plugin <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification vulnerability

Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification vulnerability discovered by Phat RiO in WordPress Plugin Handily versions = 1.0.3...

CVE-2026-94414

jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission definitions. Attackers can supply arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role...

CVE-2026-63330

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, apigetrecordingstream in warpgate-admin/src/api/recordingsdetail.rs protects /@warpgate/admin/api/recordings/uuid/stream only with session authentication and omits requireadminpermission for...