CVE-2026-59690

A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be...

WordPress BookingPress Appointment Booking Pro 5.7.2 Authentication Bypass

WordPress BookingPress Appointment Booking Pro plugin version 5.7.2 contains an authentication bypass vulnerability in its REST API that may allow an unauthenticated attacker to bypass authentication and gain unauthorized access. The repository contains technical analysis, threat intelligence...

CVE-2026-12082

CVE-2026-12082 affects the Praison AI SEO WordPress plugin prior to version 5.0.7. The root cause is missing authorization checks on several REST API routes, allowing unauthenticated users to: (1) modify the permalink of any published post and (2) read the plugin’s configuration data from before ...

EUVD-2026-47877

The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint /wp-json/wc-srp/v1/earning in versions up to, and including, 32.7.0. This is due to the userhascap filter in the SRPRESTEarningController class unconditionally granti...

CVE-2026-46737

Dell PowerProtect Data Manager (versions prior to 20.2.0.0) contains an Improper Input Validation vulnerability in its REST API. A high-privilege attacker with remote access could exploit this flaw to achieve remote code execution. In practice, this affects the REST API surface and is mitigated b...

CVE-2026-46737

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contains an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...

PT-2026-63429

Name of the Vulnerable Software and Affected Versions Dell PowerProtect Data Manager versions prior to 20.2.0.0 Description An improper input validation issue exists within the REST API. A high privileged attacker with remote access could exploit this flaw to achieve remote execution...

EUVD-2026-46270

Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callback of the ninja-forms/submissions-table Gutenberg block that allows authenticated attackers with Author-level privileges to expose stored form submissions to unauthenticated...

CVE-2026-65009

OpenRemote prior to v1.26.2 is affected by an information disclosure in the SyslogResource REST endpoint. The vulnerability allows attackers with the read:rules role to call GET /api/{realm}/syslog/event and read operational logs from all tenants, exposing asset IDs, agent connection details, rul...

CVE-2026-13439 Easy Form Builder by WhiteStudio <= 4.0.11 - Unauthenticated Privilege Escalation to Administrator via Password Recovery REST Endpoint

The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier 'sid' as the password reset token store...

📄 WordPress Masteriyo LMS 1.7.1 Privilege Escalation

WordPress Masteriyo LMS learning-management-system plugin version 1.7.1 contains an authenticated Student+ privilege escalation to administrator vulnerability. A remote attacker can elevate privileges to the administrator role and take control of the affected site. This proof of concept exploit...

CVE-2026-44231

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged non-administrative user can obtain authentication credentia...

CVE-2026-44231

CVE-2026-44231 affects RT REST 2.0: a privileged (non-administrative) user can obtain authentication credentials belonging to other users (including admins) and use them to read data via RT’s feed endpoints. The same request that exposes credentials also rotates them, invalidating existing feed U...

CVE-2026-44231 RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged non-administrative user can obtain authentication credentia...

CVE-2026-63030 WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

Cross-site Scripting (XSS)

Overview plone.app.textfield is a Affected versions of this package are vulnerable to Cross-site Scripting XSS. via the RichTextValue.output function when the stored mimeType equals the outputMimeType, causing unsanitized content to bypass the safehtml transform and be rendered directly. An...

EUVD-2026-44959

Yamcs is a mission control framework. Prior to 5.12.7, the Yamcs script evaluation engine for Python algorithms dynamically compiled and evaluated user-controlled algorithm text using Jython through the JSR-223 ScriptEngine API without enforcing a secure sandbox, so an authenticated user with the...

CVE-2026-44632 Yamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`

Yamcs is a mission control framework. Prior to 5.12.7, a server-side code injection vulnerability existed in the Yamcs algorithm evaluation engine org.yamcs.algorithms.JavaExprAlgorithmExecutionFactory, which dynamically compiled and evaluated user-controlled algorithm text through the Janino...

CVE-2026-59237 IDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of orders

Authorization Bypass Through User-Controlled Key CWE-639 in the Order and OrderItem REST API controllers in Roskus Prospero Flow CRM before 5.5.3 allows a remote, authenticated user to read, modify, and delete orders and order items belonging to any other company tenant via a sequential numeric i...

GHSA-4VPF-W7QV-5H3Q MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs

Unvalidated notetype Parameter in mcissueupdate SOAP Endpoint Allows creation of TIMETRACKING and REMINDER Notes. The SOAP path passes the user-supplied notetype integer directly to bugnoteadd without validating that the user is authorized to create that type of note. If the user's access level i...