WordPress Classified Listing plugin < 5.4.4 - Contributor+ Store Revenue Total Disclosure via rtcl_revenue_order_search vulnerability

Contributor+ Store Revenue Total Disclosure via rtclrevenueordersearch vulnerability discovered by Huseyin Mertoglu in WordPress Plugin Classified Listing versions 5.4.4...

CVE-2026-19709

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...

CVE-2026-19406

The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses...

CVE-2026-14826

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including...

CVE-2026-19709 Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...

CVE-2026-19709

The Membership For WooCommerce WordPress plugin (versions before 3.1.2 ) is vulnerable to an unauthenticated member data disclosure. The root cause is a failure to verify if an API consumer secret has actually been generated before comparing it against a value supplied in a request. On sites wher...

EUVD-2026-62291

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...

CVE-2026-19709 Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...

CVE-2026-19406

The Easy Appointments WordPress plugin (versions before 4.0.1 ) contains a sensitive information disclosure vulnerability. The root cause is a failure to restrict one of its appointment-listing REST endpoints to records belonging only to the requesting user. Consequently, users with contributor-l...

CVE-2026-19406 Easy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments Listing

The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses...

CVE-2026-14826 Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including...

EUVD-2026-62266

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including...

CVE-2026-14826

The Quiz and Survey Master (QSM) WordPress plugin versions before 11.2.4 is vulnerable to an IDOR (Insecure Direct Object Reference) flaw. The plugin fails to perform per-object ownership checks on specific REST routes that return a quiz's email-notification and results-page configurations. This ...

CVE-2026-76400: Uncontrolled Resource Consumption

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer REST API and influence responses from a Hypertext Transfer Protocol HTTP Event Collector endpoint in Splunk Enterprise could cause the connector to retry faile...

PT-2026-78778

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Splunk Secure Gateway versions prior to 3.10.9 Splunk Secure Gateway...

CVE-2026-76357: Improper Limitation of a Pathname to a Restricted Directory

In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could submit a crafted file path to the Representational State Transfer REST API and execute arbitrary code. The vulnerability is possible because the REST API does not require an assigned role for the request and do...

PT-2026-78816

Name of the Vulnerable Software and Affected Versions Cisco Talos Intelligence for Enterprise Security Cloud versions prior to 1.0.3 Description A user with the get talos enrichment capability can send a crafted request to the Talos intelligence enrichment REST API endpoint, forcing the instance ...

CVE-2026-76309: Improper Neutralization of Special Elements used in an SQL Command

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the "admin" or "power" Splunk roles could inject Structured Query Language SQL through the Representational State Transfer REST API, causing Splunk Enterprise to evaluate...

CVE-2026-76313: Improper Access Control

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code Execution RCE by uploading a malicious knowledge bundle and causing it to be used by distributed search, which can allow for access to all...

PT-2026-78736

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A low-privileged user without admin or power roles can...