CVE-2026-16578

The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, ema...

CVE-2026-16578 Admin Safety Guard < 1.4.0 - Unauthenticated User Data Disclosure via 2fa/app/users REST Route

The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, ema...

CVE-2026-52880

Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both REST APIs are started with the Gin Engine.Run convenience method, which serves requests through Go's default HTTP server with ...

CVE-2026-52880

Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both REST APIs are started with the Gin Engine.Run convenience method, which serves requests through Go's default HTTP server with ...

CVE-2026-52880 Klever-Go: REST API slow-header connection exhaustion via Gin Engine.Run

Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both REST APIs are started with the Gin Engine.Run convenience method, which serves requests through Go's default HTTP server with ...

CVE-2026-69127

Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby...

CVE-2026-69127 Kirby: System path exposure from error messages in the REST API

Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby...

CVE-2026-69127

Kirby (open-source CMS) has a REST API flaw where, prior to 4.9.5 and from 5.0.0 through 5.5.1, the API error handler can return unsanitized PHP error messages that reveal the full filesystem path of the Kirby installation to unauthenticated API users. The issue affects all sites that have not di...

CVE-2026-69127 Kirby: System path exposure from error messages in the REST API

Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby...

CVE-2026-47362

In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase notification title, message, recipient, service, tags, and on-call/incident deep links and SearchRecentDatabase the user's full in-a...

CVE-2026-47362

In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase notification title, message, recipient, service, tags, and on-call/incident deep links and SearchRecentDatabase the user's full in-a...

CVE-2026-47362

In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase notification title, message, recipient, service, tags, and on-call/incident deep links and SearchRecentDatabase the user's full in-a...

CVE-2026-47362

In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase notification title, message, recipient, service, tags, and on-call/incident deep links and SearchRecentDatabase the user's full in-a...

CVE-2026-14644

Nexus Repository 3 contains a privilege escalation vulnerability in the REST privileges API. An authenticated user who can manage privileges can elevate to full administrator under certain role configurations by abusing a type-confusion flaw in the privilege update endpoint. The CVE entry describ...

WordPress REST API Log plugin <= 1.7.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Aydan Arabadzha in WordPress Plugin REST API Log versions = 1.7.1...

CVE-2026-14943

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read...

CVE-2026-16258

CVE-2026-16258 : The Ajax Search Lite WordPress plugin prior to 4.14.5 is vulnerable to deserialization of untrusted input, enabling unauthenticated PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite plugin before 4.14.5, this can be leveraged to ach...

CVE-2026-14943 Password Protected < 2.8.4 - Unauthenticated Sensitive Information Exposure via REST API

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read...

EUVD-2026-54209

The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful...

EUVD-2026-54195

The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at...