CVE-2026-97880

The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with...

EUVD-2026-121261

The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with...

PT-2026-141790

The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials. A remote unauthenticated attacker can invoke protected resources, bypassing authentication. Only deployments that use the embedded HTTP server with...

CVE-2026-76780

The Beyondseo plugin for WordPress (versions up to and including 1.3.6 ) is vulnerable to limited privilege escalation due to improper authorization. The plugin grants rankingcoach_write_redirectManager capabilities to the Contributor role via BaseModule::defineCapabilities(). Because the module'...

CVE-2026-76780 BeyondSEO <= 1.3.6 - Missing Authorization to Authenticated (Contributor+) Limited Privilege Escalation

The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.6. This is due to the plugin permanently granting the 'rankingcoachwriteredirectManager' and sibling rankingcoachwrite module capabilities to the Contributor role via...

CVE-2026-76780: rankingcoach: The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.6

The Beyondseo plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.3.6. This is due to the plugin permanently granting the 'rankingcoachwriteredirectManager' and sibling rankingcoachwrite module capabilities to the Contributor role via...

BlueSpice GmbH authorization issue vulnerability

Versions 5.0.0 through 5.1.11 and 5.2.0 through 5.2.7 of GmbH BlueSpice contain an authorization issue vulnerability. This vulnerability arises because calls to UserManager::blockUser and UserManager::unblockUser via REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/dele...

PT-2026-118583

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0 Description The REST endpoints 'GET /api/v1//: id/locales' and 'GET /api/v1/@apostrophecms/page/: id/locales' fail to apply the publicApiCheckAsync authorization gate used by other read routes. This allow...

WordPress WP Map Block plugin <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Map Publish/Unpublish/Delete via set_status() and bulk() REST Endpoints vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Map Publish/Unpublish/Delete via setstatus and bulk REST Endpoints vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP Map Block versions = 3.0.0...

CVE-2026-90989

The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff...

CVE-2026-90989

The Tainacan WordPress plugin before version 1.4.0 contains a vulnerability where its reports REST endpoints lack proper access controls. Specifically, the plugin fails to restrict these endpoints to users with management capabilities, which allows any authenticated subscriber to disclose the ema...

CVE-2026-90989 Tainacan < 1.4.0 - Subscriber+ Repository Staff Email Address Disclosure via Reports REST Endpoints

The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff...

EUVD-2026-100861

The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff...

CVE-2026-106098 WP Data Access < 5.5.77 - Unauthenticated Incorrect Authorization via Inline App Update

The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access ev...

PT-2026-113690

The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff...

CVE-2026-90989: Exposure of Sensitive Information to an Unauthorized Actor

The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff...

CVE-2026-86798

The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the values stored through them before outputting them in a public page, allowing unauthenticated users to inject arbitrary web scripts that will execute in the...

EUVD-2026-96768

The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the values stored through them before outputting them in a public page, allowing unauthenticated users to inject arbitrary web scripts that will execute in the...

CVE-2026-86798 HootBoard <= 3.1.4 - Unauthenticated Stored XSS via Board Configuration REST Endpoint

The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the values stored through them before outputting them in a public page, allowing unauthenticated users to inject arbitrary web scripts that will execute in the...

PT-2026-110042

Name of the Vulnerable Software and Affected Versions HootBoard WordPress plugin versions prior to 3.1.5 Description The plugin fails to perform authorization checks on certain REST endpoints and does not escape stored values before they are displayed on public pages. This allows unauthenticated...