Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the `Claim` branch in `hydra-plutus/validators/deposit.ak` checks only that `datum.head_id` matches the attacker-controlled `redeemer.currencySymbol` and that the transaction is valid before the deposit deadline. It neither requires spending the Head state-token UTxO in the same transaction nor constrains outputs. After a deposit made through `POST /commit` is confirmed, any third party able to build a Cardano transaction can observe and consume the pending deposit UTxO before its deadline and redirect the assets to an arbitrary address. A standalone deposit spend invokes no Head validator, bypassing its safety checks; historical head-ID binding and the Aiken rewrite retained this missing invariant. The default deadline is three times depositPeriod, so the described attack applies to pending deposits before that deadline. This issue is fixed in version 2.1.0.
The OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary other users' placement rows (position, sort order, parent folder, and meta) and read serialized metadata — including title, permalink, and post status — of the entities those orphaned placements reference. Exploitation requires at least one orphaned placement to exist — a state produced naturally by the plugin's own trash cascade, which marks a parent folder as trashed while leaving child placements' parent_id intact — and the attacker must first self-enable OpenStation via the save-openstation AJAX endpoint, which requires only the 'read' capability held by every default WordPress role. This was also independently found by the OpenStation team.
The Email Templates Customizer and Designer for WordPress and WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enumerate WooCommerce order IDs via the preview_order parameter and exfiltrate every customer's billing name, address, phone number, and email address. The exploit requires two unauthenticated requests: the first harvests a reusable nonce from the 302 Location header returned by the unguarded admin_init handler, and the second supplies that nonce alongside an arbitrary order ID to the preview endpoint, making full customer PII disclosure trivially achievable without any account or credentials.
The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.5.4 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to enumerate and read metadata — including post ID, title, date, author, and status — of all private and draft posts on the site, including those authored by other users.
Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` omits `@authenticate` on its Resource handlers, while normal APIs require an API key and no global authentication hook compensates. Anonymous callers can invoke `POST /api/plex/oauth/logout` to clear credentials and disable the integration, or `POST /api/plex/apikey` to persist an attacker-selected key, without a PIN, account or state precondition. `POST /api/plex/oauth/pin` and `GET /api/plex/oauth/pin/<pin_id>/check` additionally allow an attacker who completes a PIN with an attacker-controlled Plex account to bind that account's token to the instance. `PlexPinCheck` skips state validation when `state_param` is absent and merely logs a mismatch without stopping execution. `POST /api/plex/select-server`, `POST /api/plex/oauth/servers`, `POST /api/plex/webhook/create`, `POST /api/plex/webhook/delete` and `POST /api/plex/encrypt-apikey` expose further `write_config()` operations. Attacker-controlled server URLs feed later outbound requests carrying the configured API key in `X-Plex-Token`, enabling server-side request forgery and credential exposure in addition to persistent configuration tampering and integration denial of service. Version 1.5.7-beta.14 closes the anonymous API-mutation path by adding authentication; complete OAuth state validation is not established and remains a separate residual for curator review.
CVE-2026-61806 is a missing authorization vulnerability in Frappe Learning Management System (LMS) versions prior to 2.54.2. It allows unauthorized users with limited privileges to retrieve and view unpublished certificate records belonging to other users. Published certificates remain accessible as intended for third-party verification. The flaw does not permit data modification or privilege escalation. The issue is fixed in version 2.54.2.
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a `REST` bypass, an authenticated student can record a passing or perfect quiz result without their answers being verified, unlocking course completion and certificates. The student can also create a submission attributed to another user, exhausting that user's allowed attempts and blocking legitimate submissions. These integrity and availability issues are scoped to quiz results; they do not expose other users' data or grant elevated roles. This issue is fixed in version 2.54.0.
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKE_REGISTRY_LAUNCH_HOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-run reads a registry writable by another party and a run-capable caller invokes the affected tool, the registry writer can choose the program and arguments executed with the operator's environment and workspace access. The --allow-run and --protect name globs do not contain the issue because the descriptor supplies those names, and the optional destructive confirmation displays a description controlled by the same writer. The local default registry populated only through zuke register is not affected because that command writes module-form descriptors. This issue is fixed in version 1.51.0.
CVE-2026-61739 is an improper authentication vulnerability in SOCFortress CoPilot prior to version 0.1.77. The issue allows attackers to create suppression rules without valid credentials due to missing role and tenant authorization checks in Velociraptor Sigma exclusion-management endpoints. Low-privilege users can enumerate and modify detection tuning data, potentially suppressing alerts platform-wide. The vulnerability is fixed in version 0.1.77.
ManageEngine SharePoint Manager Plus versions from 450 up to but not including 4507 have an improper access control vulnerability in the multi-factor authentication (MFA) feature. A low-privileged authenticated user can bypass authorization to read, modify, enable, disable MFA settings, enumerate MFA users, and delete MFA-enrolled accounts. This can weaken authentication protections or cause denial of service by locking out legitimate users. The issue is fixed in build 4507.
CVE-2026-61708 is an improper access control vulnerability in SOCFortress CoPilot prior to version 0.1.76. It allows low-privilege customer users to upload files to arbitrary storage buckets and object names without restrictions, enabling overwriting of cross-tenant data such as endpoint telemetry, report templates, and forensic artifacts. This can lead to tampering with evidence, poisoning of reports for potential code execution, and denial of service via storage exhaustion. The issue is fixed in version 0.1.76.
CVE-2026-110732 is a missing authorization vulnerability in the AI Engine – MCP Server & AI Chatbot for WordPress plugin up to version 3.8.6. The flaw exists in the MCP module's OAuth 2.1 Dynamic Client Registration endpoint, which allows unauthenticated users to register OAuth clients with attacker-controlled redirect URIs. This can lead to attackers obtaining administrator-level access after the OAuth consent screen approval. The consent page lacks protections against clickjacking, increasing the risk of unauthorized approval.
CVE-2026-118101 is a missing authorization vulnerability in the BuddyForms WordPress plugin versions before 2.10.1. It allows users with edit access to a form, including low-privilege roles such as Subscriber, to modify the title, content, and status of posts or pages authored by other users, including administrators. This flaw arises because the plugin does not verify that the user editing a post is the original author.
CVE-2026-118072 is a missing authorization vulnerability in the Fraud Prevention For WooCommerce and EDD WordPress plugin versions before 2.3.6. The plugin fails to verify that a user has permission to manage orders before allowing them to add customer details to the fraud blacklist. This flaw could let users with the Subscriber role or higher block legitimate customers from placing orders.
The Content Egg – Affiliate Product Importer & Price Comparison WordPress plugin up to version 12.0.0 has an authorization bypass vulnerability. Authenticated users with author-level access or higher can create posts attributed to other users, including administrators, by exploiting improper authorization checks. This can lead to published posts appearing as if created by an administrator, despite being created by a lower-privileged user.
Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress versions up to 12.0.0 has a missing authorization check vulnerability in the ajaxUpdateProducts() function. Authenticated users with contributor-level access or higher can modify product data on arbitrary posts without proper per-post permission verification. This occurs because the function trusts user-supplied post IDs and only checks a static nonce and generic edit_posts capability, lacking the necessary per-post edit permission check.
CVE-2026-96389 is a missing authorization vulnerability in the Drupal Xray Audit module that allows forceful browsing. It affects multiple versions of Xray Audit prior to 1.6.3, 2.0.4, and 3.1.1. The vulnerability can lead to unauthorized access to resources. The CVSS score is 6.5, indicating a medium severity level.
CVE-2026-107267 is a missing authorization vulnerability in the Drupal DKAN module that allows forceful browsing. It affects DKAN versions from 0.0.0 up to but not including 4.0.4, and from 4.1.0 up to but not including 4.1.5. The vulnerability has a medium severity with a CVSS score of 5.3 and impacts confidentiality by allowing unauthorized read access. Fixed versions 4.0.4 and 4.1.5 address this issue.
CVE-2026-107309 is a missing authorization vulnerability in the Drupal Easy Breadcrumb module that allows forceful browsing. It affects Easy Breadcrumb versions from 0.0.0 up to but not including 2.0.11. The vulnerability has a low CVSS score of 3.7 and is fixed in version 2.0.11.