CVE-2026-63619

Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This...

CVE-2026-110900

Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.5...

CVE-2026-111396

Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Post Manager: from n/a through 4.5.6...

CVE-2026-110896

Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.18...

CVE-2026-111397

Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Retrieve Embedded Sensitive Data.This issue affects MapSVG: from n/a through 8.16.1...

EUVD-2026-102869

Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.18...

EUVD-2026-102866

Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Post Manager: from n/a through 4.5.6...

EUVD-2026-102865

Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.61.0...

EUVD-2026-102861

Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.26...

CVE-2026-111397

The WordPress MapSVG plugin (versions

CVE-2026-111397 WordPress MapSVG plugin <= 8.16.1 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Retrieve Embedded Sensitive Data.This issue affects MapSVG: from n/a through 8.16.1...

EUVD-2026-102858

Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Retrieve Embedded Sensitive Data.This issue affects MapSVG: from n/a through 8.16.1...

EUVD-2026-102852

Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This...

CVE-2026-63619 Apache Kylin: Missing authorization and path-confinement on system meta dump

Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This...

CVE-2026-63619

Apache Kylin versions 4 through 5.0.4 are affected by a Missing Authorization vulnerability (CWE-862). A backend metadata dump API lacks sufficient authorization and path-confinement, potentially allowing unauthorized access to metadata. The impact is highest for services directly exposed to the ...

CVE-2026-110029 Squeeze < 1.8.1 - Subscriber+ Missing Authorization via squeeze_restore_attachment

The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing authenticated users with a role as low as Subscriber to revert any attachment to its backup copy and to permanently delete that backup and the plugin's generated WebP derivatives,...

CVE-2026-110029

The Squeeze WordPress plugin (versions before 1.8.1 ) is vulnerable to an authorization bypass due to a missing capability check on an AJAX action . This flaw allows authenticated users with Subscriber privileges or higher to revert any attachment to its backup copy. Furthermore, attackers can pe...

WordPress Squeeze plugin < 1.8.1 - Subscriber+ Missing Authorization vulnerability

Subscriber+ Missing Authorization vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Squeeze versions 1.8.1...

CVE-2026-110366

Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.4...

CVE-2026-19798

The WP Map Block plugin for WordPress (versions up to and including 3.0.0 ) is vulnerable to unauthorized data modification due to a missing capability check in the Maps_Controller REST controller. Specifically, the set_status() and bulk() functions lack object-level ownership checks or publish-l...