CVE-2026-68559 Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)

Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExportuser authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always...

CVE-2026-76032

Pydio Cells 5.0.0 through 5.0.2 is affected by a missing authorization flaw in the REST handler for GET /a/share/link/{Uuid} in idm/share/rest/handler.go. Unlike the sibling handler for GET /a/share/cell/{Uuid}, which enforces MatchPolicies with ResourcePolicyAction_READ, the link handler calls L...

CVE-2026-66685

Unauthenticated Sensitive Data Exposure in Featured Video Plus = 2.3.3 versions...

CVE-2026-66683

Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript = 2.0.16 versions...

CVE-2026-66685

Unauthenticated Sensitive Data Exposure in Featured Video Plus = 2.3.3 versions...

EUVD-2026-53894

Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript = 2.0.16 versions...

EUVD-2026-53947

Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier = 2.52.0 versions...

EUVD-2026-49245

Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor = 2.8.0 versions...

CVE-2026-66438

Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor = 2.8.0 versions...

EUVD-2026-49217

Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking = 1.0.0 versions...

PT-2026-64936

Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking = 1.0.0 versions...

PT-2026-64965

Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor = 2.8.0 versions...

CVE-2026-65521

Unauthenticated Sensitive Data Exposure in WP Social Ninja = 4.3.0 versions...

EUVD-2026-48114

Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

CVE-2026-65505

CVE-2026-65505 concerns WordPress sites using the Ultimate Store Kit Elementor Addons plugin, affected versions

CVE-2026-65490

The CVE-2026-65490 entry concerns the WordPress plugin Create by Mediavine (versions <= 2.5.3), with unauthenticated sensitive data exposure identified. The connected records confirm the affected software (Create by Mediavine plugin) and the version bound (

EUVD-2026-48153

Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice = 2.2.6 versions...

PT-2026-63933

Unauthenticated Sensitive Data Exposure in WP Social Ninja = 4.3.0 versions...

kintara-security-assessment

Kintara.gg — Full Security Assessment & Exploit Suite Date:...

WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability discovered by Jagadesh Achanta - Independent in WordPress Plugin Kirki versions = 6.0.11...