EUVD-2026-82658

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users'...

CVE-2026-81340

The MasterStudy LMS WordPress Plugin (versions prior to 3.7.50 ) contains an authorization bypass vulnerability due to a lack of per-object ownership or capability checks when updating orders via its REST API . This allows authenticated users with the Instructor role to manipulate any order on th...

CVE-2026-81340 MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users'...

CVE-2026-81340 MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users'...

PT-2026-95270

Name of the Vulnerable Software and Affected Versions The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress versions prior to 1.8.7 Description An authorization bypass exists because the plugin fails to properly...

WP < 7.1.1 - Author+ Path Traversal via Templates REST API

Description WordPress does not properly validate template identifiers passed to a REST API endpoint in some cases, which could allow users with a role as low as author to read HTML files outside of the themes directory via path traversal...

CVE-2026-93852: Missing Authorization

In OpenStack Blazar before 17.0.1, the V2 lease listing operation GET /v2/leases returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate leases belonging to other tenants, exposing...

PT-2026-95632

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description A missing authorization check in the REST API allows a remote authenticated attacker to gain elevated privileges. Recommendations At the moment, there is no information about a newer versio...

PT-2026-95231

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description Insufficient per-object ownership or capability checks occur when updating orders via the REST API. This allows users with the Instructor role to modify any order on the sit...

PT-2026-95602

Name of the Vulnerable Software and Affected Versions OpenStack Blazar versions prior to 17.0.1 Description The V2 lease listing operation at the 'GET /v2/leases' endpoint fails to enforce project scoping or administrator-only policies. This allows any authenticated user with access to the REST A...

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-mult-vul-ymSsTLCc)

According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities. - A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks. CVE-2026-20284 - A vulnerability in the SXP REST API of Cisco ISE could all...

Cisco Identity Services Engine (cisco-sa-ise-multi-hrP9jQSQ)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device. This vulnerability is due to the REST API web...

PT-2026-95295

The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and including, 2.3.38 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2026-82885: Missing Authorization

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to gain elevated privileges due to missing authorization in the REST API...

CVE-2026-81340: Authorization Bypass Through User-Controlled Key

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users'...

WP < 7.1.1 - Author+ Unauthorized Note Reparenting via REST API

Description WordPress does not validate the target post when a comment or note is moved to another post through the REST API in some cases, which could allow users with a role as low as author to attach their own notes to posts they are not allowed to edit...

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-multi-hrP9jQSQ)

According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities. - A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation o...

The vulnerability of the REST API web interface component based on artificial intelligence allows a hacker to induce a service failure.

The vulnerability of the REST API web interface component based on artificial intelligence is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

IBM MQ 9.1 < 9.1.0.38 LTS / 9.2 < 9.2.0.44 LTS / 9.3 < 9.3.0.42 LTS / 9.4 < 9.4.0.26 LTS / 9.3 - 10.0.0.0 CD < 10.0.0.5 (7284895)

The version of IBM MQ Server running on the remote host is 9.1.0.0 prior to 9.1.0.38 LTS, or 9.2.0.0 prior to 9.2.0.44 LTS, or 9.3.0.0 prior to 9.3.0.42 LTS, or 9.4.0.0 prior to 9.4.0.26 LTS, or a 9.3.x / 9.4.x CD release, or 10.0.0.0. It is, therefore, affected by a vulnerability as referenced i...

WordPress CheckView plugin < 2.3.2 - Administrator Account Creation via REST API Authentication Bypass vulnerability

Administrator Account Creation via REST API Authentication Bypass vulnerability discovered by Usama Arshad in WordPress Plugin CheckView Automated Testing versions 2.3.2...