TRUfusion Enterprise <= 7.10.4.0 - Admin Contact Portal

TRUfusion Enterprise versions 7.10.4.0 and earlier contained a vulnerability that allowed unauthenticated access to the Internal Admin Contact Page, resulting in the disclosure of PII including partner and contact names. id: CVE-2025-27225 info: name: TRUfusion Enterprise = 7.10.4.0 - Admin Conta...

CVE-2026-13736

The NewPath WildApricotPress Add-on WordPress plugin (Member Directory) through 1.0.0 fails to enforce members-only field privacy on an unauthenticated REST route. This allows anonymous visitors to read member email addresses and phone numbers that are configured to be visible only to authenticat...

CVE-2026-13736 NewPath WildApricotPress Add-on – Member Directory <= 1.0.0 - Unauthenticated Member PII Disclosure via REST API

The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only...

CVE-2026-18778 TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Customer PII Disclosure via Multiple AJAX Actions

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to retrieve the personal information of customers who booked an appointment, including their name, email address, phone number and postal address...

CVE-2026-18778

The TrueBooker WordPress appointment-booking plugin (versions before 1.2.7) lacks authorization checks in several AJAX endpoints, allowing unauthenticated remote attackers to retrieve customer PII—name, email, phone, and postal address—via crafted requests. CVSS 3.1 scores this MEDIUM (5.3). No e...

BIT-MASTODON-2026-72915 Mastodon: Personally-identifying information disclosure due to incorrect access control validation

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0 until 4.6.4 and 4.7.0, any logged-in local user could use the show action in app/controllers/admin/collectionscontroller.rb to access personally identifying information about another local user in a collection...

CVE-2026-19088 ShopEngine < 4.9.3 - Customer PII Disclosure via Forced Authentication

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing an attacker to log a victim into an attacker-controlled account, so that the billing and shipping details the victim then enters at checkout...

CVE-2026-19088

The CVE-2026-19088 affects the ShopEngine Elementor WooCommerce Builder Addon for WordPress (older than 4.9.3). The issue is an CSRF vulnerability on an authentication endpoint, which can allow an attacker to log a victim into an attacker-controlled account. As a consequence, billing and shipping...

CVE-2026-13168

The CVE concerns the Eventin WordPress plugin, affected up to version 4.1.19 (before 4.1.20). The underlying issue is insufficient access control to stored customer records exposed via REST API, allowing users with contributor-level access and above to read other customers’ personal data (names a...

CVE-2026-13168 Eventin < 4.1.20 - Contributor+ Customer PII Disclosure via REST API

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses...

CVE-2026-72543 OpenSignLabs OpenSign - Insecure Direct Object Reference

An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any contact record via the getcontact Parse cloud function. The function executes with useMasterKey and performs no authentication or authorization checks...

CVE-2026-72915 Mastodon: Personally-identifying information disclosure due to incorrect access control validation

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collectionscontroller.rb to access personally identifying information about another local user in...

CVE-2026-72915 Mastodon: Personally-identifying information disclosure due to incorrect access control validation

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collectionscontroller.rb to access personally identifying information about another local user in...

CVE-2026-17020 Salon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII Disclosure

The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user including a Subscriber or self-registered customer account to disclose...

Authorization Bypass Through User-Controlled Key

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the getRoleUserMembers path in RoleContainerResource...

Exploit for CVE-2025-60357

CVE-2025-60357- NoSQLMongoDB Injection Vulnerab...

CVE-2026-37981

A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote authenticated user, who owns at least one User-Managed Access UMA resource, to enumerate and harvest personally identifiable information PII for all realm users. By...

PT-2026-41871

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A broken access control issue exists in the Account Resources user lookup endpoint. A remote authenticated user who owns at least one User-Managed Access UMA resource can enumerate and harve...

Exploit for CVE-2026-40776

CVE-2026-40776 Eventin wp-event-solution Broken Access C...

CVE-2026-4106 HT Mega < 3.0.7 – Unauthenticated PII Disclosure

The HT Mega Addons for Elementor WordPress plugin before 3.0.7 contains an unauthenticated AJAX action returning some PII such as full name, city, state and country of customers who placed orders in the last 7 days...