EUVD-2026-62280

The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request...

CVE-2026-18466

The WP Maps WordPress plugin (versions before 4.9.8 ) contains a vulnerability where one of its AJAX actions fails to perform a capability check or validate a nonce . This flaw allows users with a Subscriber account to create an unlimited number of options in the database. Each created option is ...

CVE-2026-18466 WP Maps < 4.9.8 - Subscriber+ Unlimited Autoloaded Option Creation

The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request...

CVE-2026-16979 SmartCrawl < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration

The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on two of its AJAX actions, allowing users with at least the Subscriber role to read the titles of private and draft posts by ID and to enumerate stored post-meta key names...

EUVD-2026-62265

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users...

EUVD-2026-62259

The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and above to modify other users' roles and metadata...

EUVD-2026-62256

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...

CVE-2026-11565

The Advanced File Manager WordPress plugin (versions prior to 5.4.13 ) contains a vulnerability where it fails to perform proper capability checks in several file management AJAX actions , specifically involving the fma_load_fma_ui function. This flaw allows users with specific roles—even as low ...

CVE-2026-11565 Advanced File Manager < 5.4.13 - Authenticated Arbitrary File Read and Write via fma_load_fma_ui

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...

CVE-2026-11565 Advanced File Manager < 5.4.13 - Authenticated Arbitrary File Read and Write via fma_load_fma_ui

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...

MINI-VR7M-MXCP-RGJQ

Bulletin has no description...

EUVD-2026-62211

Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing: from n/a through 5.2.30...

CVE-2026-76257: Missing Authorization

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who holds a Splunk role with permissions to list storage passwords but does not hold Splunk Secure Gateway administration privileges could access...

PT-2026-78577

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.3 Description An issue exists where any activated account can access maintenance records for assets within the same company without requiring specific asset or maintenance permissions. This occurs because the sho...

CVE-2026-58565: Missing Authorization

Dell Command Update DCU, versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...

PT-2026-78656

Leantime JSON-RPC API through version 3.9.0 contains a missing authorization vulnerability in the JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php. The dispatcher does not enforce authorization before invoking service-layer methods, allowing an authenticated user to call methods or a...

PT-2026-78448

Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion path traversal in J-BusinessDirectory 6.2.3 - Upload/remove accepted a client-controlled root path type could point at the component site/admin trees, did not enforce path containment, and used a weak extension check. CSRF token...

CVE-2026-76336: Missing Authorization

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search Processing Language 2 SPL2 modules across all apps and users on the instance through the SPL2 module management Representational State Transfer REST API. Thi...

CVE-2026-11565: Undefined Security Weakness

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...

CVE-2026-53547: Missing Authorization

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table...