EUVD-2026-125192

Vvveb 1.0.8.4 through 1.0.8.6 contains an authorization bypass vulnerability in the content/revisions revision action that lets low-privileged Authors read other authors' revisions. Attackers can supply a postid, languageid, and createdat timestamp to retrieve private unpublished drafts, because...

CVE-2026-126373

The Vvveb software, versions 1.0.8.4 through 1.0.8.6 , is susceptible to an authorization bypass vulnerability within the content/revisions revision action. The root cause is that the revision() action fails to enforce an admin_id ownership restriction . This allows low-privileged Authors to acce...

PT-2026-146659

Vvveb 1.0.8.4 through 1.0.8.6 contains an authorization bypass vulnerability in the content/revisions revision action that lets low-privileged Authors read other authors' revisions. Attackers can supply a post id, language id, and created at timestamp to retrieve private unpublished drafts, becau...

foreman: Cross-tenant disclosure of template revisions via unauthorized audit lookup

A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...

EUVD-2026-118527

Missing Authorization vulnerability in PublishPress PublishPress Revisions revisionary allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Revisions: from n/a through 4.2.0...

CVE-2026-120851

Missing Authorization vulnerability in PublishPress PublishPress Revisions revisionary allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Revisions: from n/a through 4.2.0...

CVE-2026-120851

The PublishPress Revisions plugin for WordPress (versions ≤ 4.2.0 ) is affected by a Missing Authorization vulnerability. This flaw allows attackers to exploit incorrectly configured access control security levels , specifically due to broken access control. The vulnerability was discovered by Pe...

CVE-2026-120851 WordPress PublishPress Revisions plugin <= 4.2.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in PublishPress PublishPress Revisions revisionary allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Revisions: from n/a through 4.2.0...

WordPress PublishPress Revisions plugin <= 4.2.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin PublishPress Revisions versions = 4.2.0...

CVE-2026-118188

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user is permitted to read a given post before returning its content through its revision-comparison feature, allowing any authenticated user, including a...

CVE-2026-118186

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not correctly restrict who may publish content, allowing users such as Contributors who can edit but not publish to make unreviewed posts and pages publicly live, bypassing...

CVE-2026-118187

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user requesting to duplicate or revise a post has access to that specific post, only that they can edit posts of that type, allowing users with...

CVE-2026-118187

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin (versions before 4.3.1 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify if a user has specific access to a post when requesting to duplicate or ...

CVE-2026-118188 PublishPress Revisions 3.9.0 - 4.2.0 - Subscriber+ Unpublished Content Disclosure

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user is permitted to read a given post before returning its content through its revision-comparison feature, allowing any authenticated user, including a...

CVE-2026-118187 PublishPress Revisions < 4.3.1 - Contributor+ Unpublished Content Disclosure via IDOR

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user requesting to duplicate or revise a post has access to that specific post, only that they can edit posts of that type, allowing users with...

WordPress PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin 3.9.0-4.3.0 - Subscriber+ Unpublished Content Disclosure vulnerability

Subscriber+ Unpublished Content Disclosure vulnerability discovered by trangdld in WordPress Plugin PublishPress Revisions versions 3.9.0-4.3.0...

CVE-2026-118186

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin (versions 3.6.0 through 4.3.0 ) contains a vulnerability where it fails to properly restrict content publishing permissions. This Incorrect Authorization (CWE-863) allows users with lower pr...

CVE-2026-118188

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin (versions 3.9.0-4.3.0 ) contains a vulnerability where it fails to verify user permissions before returning content through its revision-comparison feature. This allows any authenticated use...

EUVD-2026-117915

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user is permitted to read a given post before returning its content through its revision-comparison feature, allowing any authenticated user, including a...

EUVD-2026-117913

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not correctly restrict who may publish content, allowing users such as Contributors who can edit but not publish to make unreviewed posts and pages publicly live, bypassing...