PT-2026-78782

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 10.4 through 10.4.1 Description An unauthenticated user can retrieve information from Edge Processor pipeline configurations when the Edge Processor is enabled. This occurs because the Edge Processor service REST API...

PT-2026-78784

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description An authenticated user without an assigned role can execute arbitrary code by submitting a crafted file path to the Representational State Transfer REST API. This occurs because the REST API does...

PT-2026-78763

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 10.2 through 10.2.5 Splunk Enterprise versions 10.4.0 through 10.4.1 Description An issue exists where the SPL2 module management Representational State Transfer REST API does not sufficiently authorize and validate...

PT-2026-80218

Impact Any user who can edit a page in XWiki can use Live Data's edit REST API in XWiki to change the rights on that page. This allows the user to obtain script right on the page. Script right allows the user to execute potentially dangerous Velocity scripts and send unfiltered HTML and JavaScrip...

CVE-2026-76345: Improper Access Control

In Splunk Enterprise versions below 10.4.2, a user with a high-privilege Splunk role that can manage search head clustering could use the search head cluster member bundle Representational State Transfer REST API to write files to locations that the user account running Splunk Enterprise can writ...

PT-2026-78736

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A low-privileged user without admin or power roles can...

CVE-2026-76390: Exposure of Sensitive Information to an Unauthorized Actor

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on Representational State Transfer REST A...

CVE-2026-60797

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM component: REST. Supported versions that are affected are 17.0-26.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM Integration. Successful attacks o...

EUVD-2026-61434

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM component: REST. Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks of...

keycloak-services: keycloak-services: Vault-resolved rotated client secrets leaked via Admin REST API

A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only...

CVE-2026-76032

Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/Uuid in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for...

EUVD-2026-61205

Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/Uuid in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for...

WordPress Ezoic plugin < 2.23.1 - Unauthenticated Database Export via Content Export REST Routes vulnerability

Unauthenticated Database Export via Content Export REST Routes vulnerability discovered by Usama Arshad in WordPress Plugin Ezoic versions 2.23.1...

CVE-2026-58417

A flaw was found in Gitea. The REST API improperly exposes the organization membership of private organizations to public users. This allows an unauthenticated remote attacker to gain unauthorized access to sensitive organizational structure information, leading to information disclosure...

WordPress Everest Forms - Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints vulnerability

WordPress Everest Forms - Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin = 3.5.2 - Missing Authorization to Authenticated Delegated+ Arbitrary Plugin Activation via REST API and AJAX Endpoints vulnerability discovered by skyv3il in WordPress Plugin Everest Forms...

WordPress Simply Schedule Appointments plugin < 1.6.12.17 - Team Member+ User Email Disclosure via Users and Customers REST Endpoints vulnerability

Team Member+ User Email Disclosure via Users and Customers REST Endpoints vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Simply Schedule Appointments versions 1.6.12.17...

CVE-2026-11801

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to...

PT-2026-77298

Name of the Vulnerable Software and Affected Versions Pydio Cells versions 5.0.0 through 5.0.2 Description An authorization bypass exists in the REST handler for the endpoint "GET /a/share/link/Uuid" within the idm/share/rest/handler.go file. The handler processes the Uuid variable from the path...

RoboTask 11.0.5.1229 Authentication Bypass

RoboTask version 11.0.5.1229 contains a missing authentication vulnerability in its REST API. When the REST service is enabled with its default API-key setting, a remote unauthenticated attacker can enumerate and trigger existing tasks. Tasks execute with the privileges of the RoboTask process an...

SureForms 2.1.2 Denial of Service

SureForms version 2.1.2 and below contains a denial of service vulnerability in its form submission functionality. A remote attacker can submit a large number of attacker-controlled key-value pairs containing oversized content, resulting in resource exhaustion and temporarily preventing...