CVE-2026-92992

Dromara mayfly-go (up to 1.11.5 ) contains an authorization flaw in the AI Assistant component (file server/internal/ai/api/ai.go). The whitelist bypass is one-token wide: any compound command containing curl , wget , or sed executes automatically without approval, and that approval is granted by...

CVE-2026-92992 Dromara mayfly-go AI Assistant ai.go authorization

A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown function of the file server/internal/ai/api/ai.go of the component AI Assistant. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The...

CVE-2026-92992 Dromara mayfly-go AI Assistant ai.go authorization

A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown function of the file server/internal/ai/api/ai.go of the component AI Assistant. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The...

WordPress Divi theme 5.0-5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution vulnerability

Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Theme Divi versions 5.0-5.11.1...

Missing Authorization

Overview Umbraco.Cms.Api.Delivery is a presentation layer for the Umbraco CMS Delivery API. Affected versions of this package are vulnerable to Missing Authorization in the Content Delivery API, which enforces Public Access protection only on directly requested nodes, expanding Content Picker and...

Missing Authorization

Overview Umbraco.Cms.Web.Common is a package containing the web assembly needed to run Umbraco CMS. Affected versions of this package are vulnerable to Missing Authorization in the Content Delivery API, which enforces Public Access protection only on directly requested nodes, expanding Content...

WordPress Booking for Appointments and Events Calendar – Amelia plugin <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover vulnerability

Authenticated Custom+ Missing Authorization to Limited Account Takeover vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin Amelia versions = 2.4.4...

WordPress Booking for Appointments and Events Calendar – Amelia plugin <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass vulnerability

Missing Authorization to Unauthenticated Payment Bypass vulnerability discovered by ricky morty in WordPress Plugin Amelia versions = 2.4.5...

WordPress Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) plugin <= 9.8.1 - Missing Authorization to 2FA Bypass vulnerability

Missing Authorization to 2FA Bypass vulnerability discovered by Michael Holmquist in WordPress Plugin Really Simple SSL versions = 9.8.1...

CVE-2026-91015

The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup...

CVE-2026-91008

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information full name, email address, phone...

CVE-2026-91015

The Master Addons for Elementor WordPress plugin (versions 3.0.0-3.1.8 ) is vulnerable to unauthenticated popup deactivation. The flaw exists because the plugin fails to perform proper authorization checks on the AJAX action used to deactivate its Popup Builder popups. Instead, the action relies ...

CVE-2026-54676: Missing Authorization

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot access because src/main/java/com/erudika/scoold/api/ApiController.java in ApiController.getPostReplies does not apply...

CVE-2026-54648: Missing Authorization

CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CCPERMREAD access and do not require CCPERMDELETE for the purge, noorderpurge, or deleteguests commands. An authenticated administrator with read-only customer...

PT-2026-95071

Name of the Vulnerable Software and Affected Versions Dromara mayfly-go versions prior to 1.11.6 Description A missing authorization issue exists within the AI Assistant component, specifically in the server/internal/ai/api/ai.go file. This flaw allows for remote exploitation via a whitelist bypa...

CVE-2026-92992: Missing Authorization

A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown function of the file server/internal/ai/api/ai.go of the component AI Assistant. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The...

CVE-2026-87831: Missing Authorization

The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...

CVE-2026-74000: Missing Authorization

Contributor Broken Access Control in Simple Membership = 4.8.2 versions...

CVE-2026-54643: Missing Authorization

CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of orderid and delete-note parameters before deleting records from CubeCartordernotes, without requiring CCPERMDELETE for orders. An authenticated...

PT-2026-95120

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.52 Description Missing authorization in Storage allows a remote attacker who has compromised the renderer process to bypass site isolation by using a crafted PDF file. Site isolation is a security...