CVE-2026-14206 HT Contact Form < 2.9.3 - Unauthenticated Saved Form Draft Data Disclosure

The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data name, email, phone, address stored in form drafts...

PT-2026-69340

Name of the Vulnerable Software and Affected Versions HT Contact Form WordPress plugin versions prior to 2.9.3 Description An authorization bypass exists in the endpoint that returns saved form drafts. This allows unauthenticated users to access and read personal data stored within these drafts,...

PT-2026-69341

Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar versions prior to 9.7 Description An issue exists where the plugin fails to verify if an authenticated employee provider is associated with the customer record being accessed. This allows any user...

CVE-2026-17020: Authorization Bypass Through User-Controlled Key

The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user including a Subscriber or self-registered customer account to disclose...

PT-2026-69350

Name of the Vulnerable Software and Affected Versions MotoPress Hotel Booking WordPress plugin versions prior to 6.2.3 Description An issue exists where the software fails to verify record ownership before updating customer records. This allows any authenticated user with low-privileged...

CVE-2026-14211: Authorization Bypass Through User-Controlled Key

The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee provider is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any...

CVE-2026-46409

OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to 127.0.0.1: commonly 19141 without server-side Origin validation, loopback authentication, or Content-Type...

CVE-2026-47364

In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out. Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own...

CVE-2026-16039

The MStore API WordPress plugin, in versions prior to 4.21.0 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The plugin fails to restrict its vendor-orders endpoint to the caller's own records, which allows any authenticated user—including those with Subscriber privileges—to view ...

CVE-2025-13909

The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable...

EUVD-2025-210630

The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable...

CVE-2025-13909 Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure

The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable...

CVE-2025-13909

WSO2 Identity Server is reported to have a multi-tenant authentication flaw where requests using Email OTP, SMS OTP, or Magic Link as first factors do not adequately enforce tenant isolation. This can allow an attacker to disclose PII from other tenants (e.g., mobile numbers) due to cross-tenant ...

CVE-2026-71241

Book-Management-System's Flask API endpoints /student, /record, /books, /findstubook, and /findnotreturnbook are missing the @loginrequired decorator that protects sibling routes /searchstudent, /storage in the same file. Because cardid values are sequential integers, the entire student database...

CVE-2026-71241

Book-Management-System's Flask API endpoints /student, /record, /books, /findstubook, and /findnotreturnbook are missing the @loginrequired decorator that protects sibling routes /searchstudent, /storage in the same file. This allows any unauthenticated remote user to retrieve student PII name,...

CVE-2026-11454

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.2 via the GET /wp-json/gh/v4/contacts/ REST endpoint. The endpoint's permission callback checks only the role-level...

CVE-2026-11454 Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.2 via the GET /wp-json/gh/v4/contacts/ REST endpoint. The endpoint's permission callback checks only the role-level...

CVE-2026-70373 Koha - SQL Injection in reports/issues_stats.pl

Koha's reports/issuesstats.pl the circulation statistics report builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into...

EUVD-2026-52674

Koha's reports/borissuestop.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Criteria parameter is only normalized by a table-name prefix and is never whitelisted, landing verbatim in identifier positions SELECT...

WordPress FluentCart A New Era of eCommerce plugin < 1.5.3 - Unauthenticated Order PII Disclosure vulnerability

Unauthenticated Order PII Disclosure vulnerability discovered by Diogo Pinto in WordPress Plugin FluentCart versions 1.5.3...