CVE-2026-2520 Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, wit...

CVE-2026-2520 Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, wit...

CVE-2026-2520

The Bookly WordPress plugin (Online Scheduling and Appointment Booking System) is affected by a missing capability check on the updateAddon function in all versions up to and including 27.2 . Authenticated attackers with Subscriber-level access or higher can trigger an update of any plugin whose ...

CVE-2026-3174 Event Tickets and Registration <= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Update

The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return endpoint in all versions up to, and including, 5.27.4. This makes it possible for unauthenticated attackers to overwrite the site...

CVE-2026-3174 Event Tickets and Registration <= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Update

The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return endpoint in all versions up to, and including, 5.27.4. This makes it possible for unauthenticated attackers to overwrite the site...

CVE-2026-9331

The EDD Product Catalog Feed WordPress plugin by PixelYourSite is affected in all versions up to and including 1.0.2 . The root cause is a missing capability check on the wpeddpcf_delete_feed function, allowing any authenticated user with subscriber-level access or higher to delete arbitrary Word...

CVE-2026-77132 TYPO3 CMS - Information Disclosure via Backend Localization Wizard

It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting...

CVE-2026-77132 TYPO3 CMS - Information Disclosure via Backend Localization Wizard

It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting...

CVE-2026-77132

TYPO3 CMS is vulnerable to an information disclosure flaw in the backend localization wizard . Several AJAX routes used by this feature failed to perform authorization checks, allowing authenticated, low-privileged backend users to access information about records and content elements outside the...

CVE-2026-77132 TYPO3 CMS - Information Disclosure via Backend Localization Wizard

It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting...

CVE-2026-85400

TYPO3 CMS versions 14.2.0 through 14.3.6 are affected by a missing authorization check in its lowlevel configuration commands (configuration:read, configuration:set, configuration:show). Backend administrators without system maintainer privileges could schedule these commands, allowing them to mo...

CVE-2026-85400 TYPO3 CMS - Missing Authorization in lowlevel commands

Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to system maintainers. As a consequence, this...

CVE-2026-85400 TYPO3 CMS - Missing Authorization in lowlevel commands

Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to system maintainers. As a consequence, this...

CVE-2026-85400 TYPO3 CMS - Missing Authorization in lowlevel commands

Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to system maintainers. As a consequence, this...

TYPO3-CORE-SA-2026-023: Missing Authorization in lowlevel commands

More info at https://news.typo3.com/security/advisory/typo3-core-sa-2026-023...

CVE-2026-81790

Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Csomagpontok és szállítási címkék WooCommerce-hez: from n/a before 4.2.8...

CVE-2026-81781

Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4...

BIT-JENKINS-2026-84657

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission to cancel builds started by other users...

CVE-2026-81781 WordPress Unbounce Landing Pages plugin <= 1.1.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4...

CVE-2026-81781

Unbounce Landing Pages WordPress plugin (versions through 1.1.4 ) is affected by a Missing Authorization (Broken Access Control) vulnerability, allowing an attacker with low privileges to exploit incorrectly configured access control security levels. The CVSS 3.1 score is 7.1 (HIGH) , with a netw...