CVE-2026-66723 Missing authentication requirement in Remote Instances proxy API in MWDB Core

MWDB Core versions =2.2.0 and 2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated remote attacker to send arbitrary requests to a remote MWDB instance using the...

EUVD-2026-50359

MWDB Core versions =2.2.0 and 2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated remote attacker to send arbitrary requests to a remote MWDB instance using the...

CVE-2026-66724 Permission Bypass Via Undocumented HTTP Methods In MWDB Core

MWDB Core versions =2.0.0 and 2.19.0 contain a missing authorization vulnerability in the deprecated config and blob upload endpoints. These endpoints accept the undocumented POST method, which bypasses the capability checks applied to the documented PUT method. This allows any authenticated user...

CVE-2026-14270

Affected product: Extra Checkout Options addon for Extra Product Options & Add-Ons for WooCommerce (WordPress). Vulnerability: Arbitrary File Upload in all versions up to 2.3.2 due to missing authorization and nonce validation in eco_save_settings, enabling low-privileged authenticated users to m...

CVE-2026-50622

Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated user, regardless of their assigned role, to perform administrative operations. Affect Version: This issue affects Apache Atlas: from 0.8 through...

CVE-2025-10656

The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.37 vi the userfilter function. This makes it possible for unauthenticated attackers to create admin accounts...

CVE-2026-50622

Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated user, regardless of their assigned role, to perform administrative operations. Affect Version: This issue affects Apache Atlas: from 0.8 through...

CVE-2026-50622

CVE-2026-50622 — Apache Atlas : A missing authorization vulnerability affects Atlas versions 0.8 through 2.5.0, where admin endpoints can be accessed by any authenticated user, enabling administrative operations. The issue stems from missing authorization checks on admin functions, potentially im...

CVE-2026-50622 Apache Atlas: Missing Authorization on Admin Endpoints

Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated user, regardless of their assigned role, to perform administrative operations. Affect Version: This issue affects Apache Atlas: from 0.8 through...

CVE-2026-50622 Apache Atlas: Missing Authorization on Admin Endpoints

Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated user, regardless of their assigned role, to perform administrative operations. Affect Version: This issue affects Apache Atlas: from 0.8 through...

EUVD-2025-210524

The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.37 vi the userfilter function. This makes it possible for unauthenticated attackers to create admin accounts...

CVE-2026-5626

The CVE affects the WordPress plugin “Survey Form Block” (versions up to and including 1.0.1). A missing capability check in get_all_data() enables authenticated users with Subscriber-level access and above to export all survey submissions and column metadata. Public exploit details are not provi...

PT-2026-65890

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 16.6 through 19.0.4 GitLab CE/EE versions 19.1 through 19.1.2 GitLab CE/EE versions 19.2 through 19.2.0 Description A missing authorization check allows an unauthorized user to view project import source information under...

CVE-2026-15992

The WP Password Policy plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 3.7.1. This is due to missing authorization checks and nonce verification in the getuser function of the ModulePasswordHint class, which unconditionally calls WPUser::setrole with...

Missing Authorization

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization through the OIDC token introspection endpoint in the keycloak-services component. An...

Missing Authorization

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization through the Google token exchange flow in the Google Identity Provider token exchange...

CVE-2026-16774

The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcssendemail AJAX handler. This is due to the wpcssendemail function being registered on both wpajaxwpcssendemail and wpajaxnoprivwpcssendemail with no nonce verification,...

CVE-2026-15025

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.3.2 via the automatorgooglecontactsfetchlabels, automatormauticsegmentfetch, automatormautictagsfetch, and...

CVE-2026-13110

The Storegrowth Sales Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.1.0. This is due to a missing capability check on the bogocategorymsgcreate AJAX handler, which is registered for both authenticated wpajax and unauthenticated wpajaxnopriv...

EUVD-2026-49764

The Storegrowth Sales Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.1.0. This is due to a missing capability check on the bogocategorymsgcreate AJAX handler, which is registered for both authenticated wpajax and unauthenticated wpajaxnopriv...