CVE-2026-105995 Booking Package < 1.7.30 - Unauthenticated Booking Customer PII Disclosure

The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens...

WordPress Portfolio Filter Gallery plugin < 2.2.1 - Contributor+ Missing Authorization vulnerability

Contributor+ Missing Authorization vulnerability discovered by Artus KG in WordPress Plugin Portfolio Gallery – Image Gallery Plugin versions 2.2.1...

CVE-2026-105976

The Portfolio Filter Gallery WordPress plugin (versions before 2.2.1 ) is vulnerable to an incorrect authorization flaw (CWE-863). The plugin fails to perform proper authorization checks within a set of AJAX actions , which allows users with at least the Contributor role to perform unauthorized a...

CVE-2026-105976 Portfolio Filter Gallery < 2.2.1 - Contributor+ Missing Authorization via Multiple AJAX Actions

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor role to read, modify and delete other users' galleries as well as site-wide gallery filters...

CVE-2026-105976 Portfolio Filter Gallery < 2.2.1 - Contributor+ Missing Authorization via Multiple AJAX Actions

The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor role to read, modify and delete other users' galleries as well as site-wide gallery filters...

CVE-2026-105995

The Booking Package WordPress plugin, in versions before 1.7.30 , is vulnerable to an information disclosure flaw. The plugin fails to perform necessary authorization checks before returning stored reservation data. This allows unauthenticated users to access and disclose sensitive information, i...

CVE-2026-105995 Booking Package < 1.7.30 - Unauthenticated Booking Customer PII Disclosure

The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens...

EUVD-2026-96085

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference / Missing Authorization in versions up to, and including, 5.7.2. This is due to the publicly reachable stepsstart and stepsloadstep routes...

CVE-2026-103889

The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpvimage' parameter parameter. This is due to missing authentication and nonce checks on the wploaded handler combined with no sanitization...

HQC

Hamming Quasi-Cyclic HQC This repository provides the official implementation ofHQC, a code-based Key Encapsulation Mechanism KEM whose security is based on the hardness of solving the Quasi-Cylic Syndrome Decoding QCSD problem. HQC is one of the selected algorithms from the NIST's Post-Quantum...

CVE-2026-108648: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController, which lacks Shiro permission or role annotations. Any authenticated low-privileged user can supply datasource codes in the dbSourceCode parameter to...

PT-2026-109896

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the SysDepartController within the GET '/sys/sysDepart/getDepartmentHead' endpoint. This issue allows any authenticated user to list department staff by enumerating...

PT-2026-109872

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the AigcWordTemplateController delete handler. This issue allows any authenticated user, including those with low privileges, to permanently remove word templates fr...

PT-2026-109903

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the SysAnnouncementSendController that allows authenticated users to modify message delivery records belonging to other users. An attacker can retrieve delivery...

PT-2026-109894

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can create department permission bindings due to missing authorization. By sending requests to the endpoint "POST /sys/sysDepartPermission/add", an attacker can...

PT-2026-109873

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can delete word templates due to missing authorization in the deleteBatch handler of the AigcWordTemplateController. An attacker can permanently remove templates...

PT-2026-109884

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the deleteBatch handler of the SysLogController. This issue allows any authenticated user, including those with low privileges, to delete system audit log entries. B...

PT-2026-109897

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the appImportExcel handler within the SysDepartController. This issue allows any authenticated user, including those with low privileges, to import departments by...

PT-2026-109900

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw allows authenticated users to permanently delete data dictionaries. Low-privileged attackers can send DELETE requests to the '/sys/dict/deletePhysic/id' endpoint, which trigge...

PT-2026-109932

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists where the permission check in the queryById function is commented out in the source code. This allows any authenticated user to access the '/airag/app/queryById' endpoi...