CVE-2026-110377

Missing Authorization vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bopo – WooCommerce Product Bundle Builder: from n/a through 1.2.3...

EUVD-2026-109719

Missing Authorization vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Post & Filter Widgets for Elementor: from n/a through 1.9.1...

EUVD-2026-109712

Missing Authorization vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bopo – WooCommerce Product Bundle Builder: from n/a through 1.2.3...

EUVD-2026-109709

Missing Authorization vulnerability in WP Discussion Board WP Discussion Board wp-discussion-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Discussion Board: from n/a through 2.6.0...

CVE-2026-116107

A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrpsajaxdeletesavedsearch of the file functions/ajax.php of the component AJAX Handlers. The manipulation results in missing authorization. The attack may be launched...

EUVD-2026-109599

A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrpsajaxdeletesavedsearch of the file functions/ajax.php of the component AJAX Handlers. The manipulation results in missing authorization. The attack may be launched...

CVE-2026-116107 Datafeedr Product Sets Plugin AJAX Handlers ajax.php dfrps_ajax_delete_saved_search authorization

A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrpsajaxdeletesavedsearch of the file functions/ajax.php of the component AJAX Handlers. The manipulation results in missing authorization. The attack may be launched...

CVE-2026-116107

The Datafeedr Product Sets Plugin for WordPress, affecting versions up to 1.3.24 , contains a vulnerability in the AJAX Handlers component. Specifically, the function dfrps_ajax_delete_saved_search within the functions/ajax.php file is susceptible to missing authorization . This flaw allows for r...

PT-2026-123200

Missing Authorization vulnerability in VillaTheme DEPART depart-deposit-and-part-payment-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DEPART: from n/a through 1.0.10...

PT-2026-123202

Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.6...

PT-2026-123287

Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improve prompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improve prompt API to leverage the site owner...

PT-2026-123262

Missing Authorization vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by Supsystic: from n/a through 1.10.7...

PT-2026-123272

Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5...

PT-2026-123248

Missing Authorization vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bopo – WooCommerce Product Bundle Builder: from n/a through 1.2.3...

PT-2026-123254

Missing Authorization vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Post & Filter Widgets for Elementor: from n/a through 1.9.1...

PT-2026-123339

Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the get contact by phone number API, which performs raw database queries without invoking the permission...

UBUNTU-CVE-2026-115373

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/uuid that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve...

PT-2026-123369

Name of the Vulnerable Software and Affected Versions googleapis/mcp-toolbox versions 1.2.0 through 1.4.0 Description Path traversal and missing authorization in the cloud-storage source allow an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and...

PT-2026-125495

QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed review ajax token and enumerate sequential id orde...

PT-2026-125512

OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.project tRPC mutation that allows non-admin organization members to create projects and mint write-type ingestion credentials, bypassing the admin-only policy. Attackers can repeatedly call the endpoint with a...