PT-2026-68010

Name of the Vulnerable Software and Affected Versions HashBrown CMS versions prior to 1.4.7 Description An OS Command Injection issue exists in the media upload thumbnail generation routine. The Media.generateThumbnail function in src/Server/Entity/Resource/Media.js creates a temporary file path...

CVE-2026-16746: Authorization Bypass Through User-Controlled Key

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data...

CVE-2026-7327: Improper Privilege Management

An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with an administrative REST role to escalate privileges. This can result in unauthorized disclosure of sensitive server-si...

wp2shell-Hestia-Scanner — Updated!

🛡️ wp2shell-Hestia-Scanner 🇬🇧 English | 🇬🇷 Ελληνικά Read-only WordPress security scanner for HestiaCP servers. Detects wp2shell compromise indicators across all hosted sites — with per-client email reports, core file diff, SHA256 webshell detection, risk scoring, and optional AI evaluation. ⚠️ Safe...

CVE-2026-16547

The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests a...

CVE-2026-16547

The REST API Log WordPress plugin (versions before 1.7.1 ) is vulnerable to unauthenticated sensitive log data disclosure . The root cause is that the plugin fails to bind the security token protecting its log download feature to the specific log entry being requested, and it does not verify the ...

EUVD-2026-52600

The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests a...

CVE-2026-16547

The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests a...

PT-2026-67777

Name of the Vulnerable Software and Affected Versions HPE Networking SD-WAN Orchestrator affected versions not specified Description Multiple issues in the REST API interface allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. This could...

CVE-2026-63456: Improper Authentication

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive...

CVE-2026-16547: Improper Access Control

The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests a...

PT-2026-67776

Name of the Vulnerable Software and Affected Versions HPE Networking SD-WAN Orchestrator affected versions not specified Description Multiple issues in the REST API interface allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. This could...

PT-2026-67664

The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests a...

CVE-2026-63455: Missing Authentication for Critical Function

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive...

CVE-2026-68981

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

CVE-2026-68980

CVE-2026-68980 affects Apache NiFi 2.0.0–2.10.0. The issue is an authorization bypass in Asset management for Parameter Contexts via the REST API: deletion of an Asset is authorized by the provided Parameter Context Identifier without validating the Asset Identifier against the stored one. This c...

CVE-2026-68980

Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework...

CVE-2026-68979

Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization wa...

CVE-2026-48031

Technical details about CVE-2026-48031 are not publicly provided in the supplied documents. The go-base JWT-secret issue is described at a high level; monitor for updates for concrete affected versions, root cause, and fixes.

CVE-2026-16563 Academy LMS < 3.8.3 - Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST Endpoint

The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student Subscriber-level account to disclose the content of arbitrary lessons, including lessons of...