EUVD-2026-85043

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists...

EUVD-2026-85042

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes...

EUVD-2026-85040

The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including...

EUVD-2026-85039

The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review...

CVE-2026-83555

The Email Subscribers & Newsletters WordPress plugin (versions before 5.9.35 ) is vulnerable to an unauthenticated subscription status change . The root cause is a failure to verify the per-subscriber management token when updating subscription statuses. This allows unauthenticated users to force...

CVE-2026-83555 Email Subscribers by Icegram Express < 5.9.35 - Unauthenticated Subscription Status Change via Missing Token Verification

The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know...

CVE-2026-83555 Email Subscribers by Icegram Express < 5.9.35 - Unauthenticated Subscription Status Change via Missing Token Verification

The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know...

EUVD-2026-85033

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and...

EUVD-2026-85029

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowing any authenticated user with a minimal subscriber role to read other students' quiz grades, pass/fail status and attempt timestamps by...

EUVD-2026-85022

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings...

EUVD-2026-85019

The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update Social Commerce for WooCommerce WordPress plugin through 2.5.4 configuration and product synchronisation state...

EUVD-2026-84958

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper authentication and missing authorization...

EUVD-2026-84952

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to perform unauthorized payment mutation actions due to missing authorization...

CVE-2026-84719: Missing Authorization

A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unifiedjobtemplate, and credentials of each cloned node and fails to check the instancegroups and executionenvironment...

CVE-2026-71460: Missing Authorization

/api/v2/config/ is protected only by IsAuthenticated. licenseinfo accountnumber, subscriptionid, poolid, sku, supportlevel, instance counts returned to any authenticated user. The superuser/auditor gate only covers projectbasedir/projectlocalpaths/customvirtualenvs, not licenseinfo. Enables socia...

CVE-2026-76086: Missing Authorization

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a...

CVE-2026-19267: Missing Authentication for Critical Function

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to missing authentication on the Business Rules Manager commands REST endpoint CommandsResource.java:31. A local actor can invoke unauthenticated commands to cause resource exhaustionand halt business-rule management functio...

CVE-2026-96446: Missing Authorization

A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that...

Linux Distros Unpatched Vulnerability : CVE-2026-95301

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Extensions in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass site...

Linux Distros Unpatched Vulnerability : CVE-2026-95296

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Core in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin...