EUVD-2026-67692

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps field...

CVE-2026-82239

Budibase versions before 3.41.3 are affected by an authorization bypass in the POST /api/datasources/query endpoint. The failure to enforce per-table role restrictions allows users with the low-privilege BASIC role to submit crafted query requests targeting arbitrary table identifiers, enabling t...

CVE-2026-82239 Budibase before 3.41.3 Authorization Bypass via datasources/query

Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table regardless of configured permissions. Attackers with BASIC role can submit crafted query request...

CVE-2026-82240 Budibase before 3.41.3 Privilege Escalation via User Update API

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps field...

CVE-2026-79615

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not check authorisation when returning question bank entries through one of its REST API routes, allowing users with a role as low as Contributor to read the questions, hints and correct answer keys of quizzes belonging to other...

CVE-2026-19423

The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the site's registered role names rather than against the form's own allow-list, allowing unauthenticated...

WordPress Envira Gallery plugin <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description vulnerability

Authenticated Author+ Stored Cross-Site Scripting via Gallery Description vulnerability discovered by lord willmore - self in WordPress Plugin Envira Photo Gallery versions = 1.12.4...

CVE-2026-19423 Ultimate Member 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation via Role Field on Profile Forms

The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the site's registered role names rather than against the form's own allow-list, allowing unauthenticated...

EUVD-2026-67570

The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the site's registered role names rather than against the form's own allow-list, allowing unauthenticated...

CVE-2026-19423

Ultimate Member WordPress plugin (versions 2.6.7–2.12.1 ) is vulnerable to an unauthenticated privilege escalation discovered by Jakub Herman. When the plugin cannot resolve the set of roles a profile form permits, it validates the submitted role selection against the site's registered role names...

CVE-2026-39071

WordPress plugin Spiffy Plugin (confirmed affected on versions 5.0.8 and lower ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in the Event Title field . An authenticated attacker with the lowest-privileged role (contributor ) can inject malicious JavaScript that executes when unauthe...

CVE-2026-39071

WordPress plugin Spiffy Plugin before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privileged role contributor can exploit this to redirect user to malicious site or control the account...

EUVD-2026-67900

WordPress plugin Spiffy Plugin before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privileged role contributor can exploit this to redirect user to malicious site or control the account...

PT-2026-83346

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.19 Description Klever-Go, a Go implementation of the Klever blockchain protocol, contains an integer overflow issue in the semi-fungible token SFT add-quantity path. In the SFTAddCirculation function within...

PT-2026-82876

Name of the Vulnerable Software and Affected Versions Ultimate Member WordPress plugin versions prior to 2.13.0 Description An issue exists where the plugin fails to validate role selection when it cannot resolve the set of roles permitted by a profile form. Instead of checking against the form's...

CVE-2026-36102

An issue in the inviteController.js component in Bluewave Labs Checkmate =3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint...

WordPress Workeera plugin < 1.0.6 - Subscriber+ Arbitrary File Deletion vulnerability

Subscriber+ Arbitrary File Deletion vulnerability discovered by Artus KG and Shhriyash in WordPress Plugin Workeera versions 1.0.6...

CVE-2026-78271

Editor Privilege Escalation in FluentCRM Pro = 3.1.12 versions...

CVE-2026-81272 WordPress FluentPlayer Pro plugin <= 1.3.2 - Broken Access Control vulnerability

Editor Broken Access Control in FluentPlayer Pro = 1.3.2 versions...

CVE-2026-81272

CVE-2026-81272 affects the WordPress FluentPlayer Pro plugin in versions 1.3.2 and below , where an Editor-level Broken Access Control flaw allows a user with the Editor role to perform actions they should not be permitted to. The CVSS 3.1 score is 4.9 (MEDIUM) with the vector AV:N/AC:L/PR:H/UI:N...