PT-2026-97089

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Missing authorization in the software allows a remote authenticated attacker to perform unauthorized payment mutation actions. Recommendatio...

CVE-2025-14486: Missing Authorization

The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to delete arbitrary API keys Pixabay, Unsplash, Pixels, OpenAI configured by site...

CVE-2026-63104: Missing Authorization

Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks...

CVE-2026-93343: Missing Authorization

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketkingadminvendorsajax AJAX action that allows authenticated attackers with subscriber-level access or higher to retrieve the complete vendor directory by sending a crafted AJAX request...

CVE-2026-77518

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP toolid in the same workspace can retrieve the hidden tool through the tool-detail route because it does not apply the per-resource authorization used by the...

CVE-2026-77516 MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path

MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role workspace member denied access to a tool by WorkspaceUserResourcePermission can still bind its identifier through toolids, skilltoolids, or mcptoolids and execute it through the agent or workflow...

CVE-2026-77516 MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path

MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role workspace member denied access to a tool by WorkspaceUserResourcePermission can still bind its identifier through toolids, skilltoolids, or mcptoolids and execute it through the agent or workflow...

CVE-2026-77518 MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflows

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP toolid in the same workspace can retrieve the hidden tool through the tool-detail route because it does not apply the per-resource authorization used by the...

WordPress PixelPlay plugin <= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary API Key Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary API Key Deletion vulnerability discovered by Phat RiO in WordPress Plugin PixelPlay versions = 1.0.2...

WordPress Image Buzz plugin <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary API Key Modification vulnerability

Missing Authorization to Unauthenticated Arbitrary API Key Modification vulnerability discovered by Phat RiO in WordPress Plugin Image Buzz versions = 1.0.3...

WordPress Handily plugin <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification vulnerability

Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification vulnerability discovered by Phat RiO in WordPress Plugin Handily versions = 1.0.3...

CVE-2026-94414

jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission definitions. Attackers can supply arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role...

CVE-2026-63330

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, apigetrecordingstream in warpgate-admin/src/api/recordingsdetail.rs protects /@warpgate/admin/api/recordings/uuid/stream only with session authentication and omits requireadminpermission for...

WordPress ThumbPress – Compress Images, Manage Thumbnails, Detect Image Issues, WebP/AVIF, Lazy Loading, Hotlinking & More plugin <= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation vulnerability

Missing Authorization to Authenticated Subscriber+ Plugin Deactivation vulnerability discovered by Que Thanh Tuan in WordPress Plugin ThumbPress versions = 6.2.1...

WordPress wpForo Forum plugin <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover vulnerability

Missing Authorization to Authenticated Subscriber+ Guest Post Takeover vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin wpForo Forum versions = 3.1.5...

WordPress WP User Manager – User Profile Builder & Membership plugin <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack vulnerability

Missing Authorization to Authenticated Subscriber+ Stripe Account Hijack vulnerability discovered by Wordfence PRISM in WordPress Plugin WP User Manager versions = 2.9.18...

CVE-2026-91167 Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:roleid reaches apiupdateuserrole in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited...

CVE-2026-91167 Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:roleid reaches apiupdateuserrole in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited...

CVE-2026-63330

Warpgate, an open source SSH, HTTPS, and MySQL bastion host for Linux, is affected by a missing authorization check prior to version 0.25.6 . The api_get_recording_stream function in warpgate-admin/src/api/recordings_detail.rs protects the recording stream WebSocket endpoint with only session aut...

CVE-2026-63330 Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, apigetrecordingstream in warpgate-admin/src/api/recordingsdetail.rs protects /@warpgate/admin/api/recordings/uuid/stream only with session authentication and omits requireadminpermission for...