CVE-2026-16563 Academy LMS < 3.8.3 - Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST Endpoint

The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student Subscriber-level account to disclose the content of arbitrary lessons, including lessons of...

CVE-2026-16563

The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student Subscriber-level account to disclose the content of arbitrary lessons, including lessons of...

CVE-2026-16563

The Academy LMS WordPress plugin (versions prior to 3.8.3 ) is vulnerable to an improper access control flaw in its REST API. The plugin fails to verify course enrollment or lesson publication status when returning a single lesson via the lessons REST endpoint . This allows users with a Subscribe...

CVE-2026-16565 Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on its product-attribute REST write endpoints, allowing users with a Dokan vendor account to modify the product attributes and default attributes of any other vendor'...

PT-2026-68858

Name of the Vulnerable Software and Affected Versions Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin versions prior to 2.8.4 Description A missing authentication check in the REST API access filter allows unauthenticated visitors to bypass th...

CVE-2026-68980: Incorrect Authorization

Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework...

CVE-2026-68981: Improper Handling of Highly Compressed Data (Data Amplification)

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

PT-2026-67496

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 2.0.0 through 2.10.0 Description Apache NiFi allows the creation, reading, and deletion of Assets associated with Parameter Contexts via the REST API. The framework authorizes asset deletion using the provided Parameter...

CVE-2026-16563: Improper Access Control

The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student Subscriber-level account to disclose the content of arbitrary lessons, including lessons of...

CVE-2026-68979: Missing Authorization

Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization wa...

PT-2026-68632

Name of the Vulnerable Software and Affected Versions Passster versions prior to 4.3.7 Description Low-privilege users with the edit posts capability can read globally password-protected content through the WordPress core REST API when global protection is enabled. This allows any user with...

CVE-2026-15939

The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end, relying there on a generic capability check instead of the Simple Restrict WordPress plugin before 1.2.9's own permission system, allowing...

EUVD-2026-51937

The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end, relying there on a generic capability check instead of the Simple Restrict WordPress plugin before 1.2.9's own permission system, allowing...

[SECURITY] Fedora 43 Update: coturn-4.15.0-1.fc43

The Coturn TURN Server is a VoIP media traffic NAT traversal server and gatew ay. It can be used as a general-purpose network traffic TURN server/gateway, too. This implementation also includes some extra features. Supported RFCs: TURN specs: - RFC 5766 - base TURN specs - RFC 6062 - TCP relaying...

CVE-2026-15939: Incorrect Authorization

The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end, relying there on a generic capability check instead of the Simple Restrict WordPress plugin before 1.2.9's own permission system, allowing...

CVE-2026-13389: Missing Authorization

The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and modify the webtoffee-cookie-consent WordPress plugin before...

CVE-2026-3141 FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameter

The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint in all versions up to, and including, 1.9.2 This is due to the REST API route being registered without any...

CVE-2026-3141: Missing Authorization

The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/attachments REST API endpoint in all versions up to, and including, 1.9.2 This is due to the REST API route being registered without any...

VulnCheck KEV: CVE-2026-53576

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API @Filter"/api/v1/" treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresse...

GHSA-6H5J-32CF-4253 Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass

Summary apos.util.set traverses dot-notation paths without sanitizing proto, allowing an authenticated editor to write arbitrary values to Object.prototype via the $pullAll patch operator. A confirmed gadget in publicApiCheck causes this to bypass authorization on all piece-type REST API endpoint...