CVE-2026-111625

10up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action

10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on sites they cannot access.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

10up

Products

Distributor

CVE-2026-105039

EnergizeLab Station Middleware Admin APIs Missing Role Checks

EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Energizelab

Products

Station-middleware

CVE-2026-111681

EFAK through 5.1.0 Privilege Escalation via /api/users REST API

EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN, create administrators, or delete users, gaining control of managed Kafka clusters.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Smartloli

Products

Efak

CVE-2026-111682

EFAK 5.0.0 through 5.1.0 Missing Authorization via /api/model-config Exposes API Keys

EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLE_USER account can query /api/model-config/page or /api/model-config/{id} to retrieve unmasked keys, enabling provider account access and incurred costs.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Smartloli

Products

Efak

CVE-2026-89072

MOVEit Transfer Authorization Flaw in Certificate Management

Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Moveit Transfer

CVE-2026-6723

Appointment Booking Calendar <= 1.6.11.11 - Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 1.6.11.11. This is due to the appointment update REST API endpoint not restricting which fields can be modified by token-authenticated customers. This makes it possible for unauthenticated attackers to modify admin-controlled fields on that appointment, including faking payment confirmation, reassigning the appointment to another user, and changing the service type.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Croixhaug Wordpress-extensions

Products

Simply Schedule Appointments Simply Schedule Appointments

CVE-2026-18947

Feast: feast: authorization bypass in /materialize endpoints enables dos via unauthorized full re-materialization

A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sending a specially crafted request that omits the feature_views field, an attacker can bypass intended permission checks. This allows an unauthenticated remote attacker, or any authenticated user, to trigger a full re-materialization of all feature views. The consequence is a Denial of Service (DoS) due to data corruption and significant resource consumption across all tenants.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Red Hat Openshift Ai (rhoai) Openshift Ai

CVE-2026-57727

WordPress Kirki plugin <= 6.2.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kirki: from n/a through 6.2.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Themeum Wordpress

Products

Kirki Wordpress

CVE-2026-107418

WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Arraytics Wordpress-extensions

Products

Booktics Booktics

CVE-2025-53230

WordPress Page Manager for Elementor Plugin <= 2.0.5 - Broken Access Control Vulnerability

Missing Authorization vulnerability in honzat Page Manager for Elementor page-manager-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Manager for Elementor: from n/a through <= 2.0.5.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Elementor Wordpress

Products

Elementor Wordpress

CVE-2025-12174

Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.5.2 - Missing Authorization to Authenticated (Subscriber+) Data Export and Slug Update

The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'directorist_prepare_listings_export_file' and 'directorist_type_slug_change' AJAX actions in all versions up to, and including, 8.5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export listing details and change the directorist slug.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpwax

Products

Wordpress Directorist

CVE-2026-109703

WordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in WPGraphQL WPGraphQL wp-graphql allows Retrieve Embedded Sensitive Data.This issue affects WPGraphQL: from n/a through 2.23.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpgraphql

Products

Wpgraphql Wpgraphql

CVE-2026-92817

Inductive Automation Ignition Software Incorrect Authorization

The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition Gateway process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Inductiveautomation

Products

Ignition

CVE-2026-78433

Gitea private attachment disclosure through repository mismatch

Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea

CVE-2026-73804

Gitea API token scope escalation through HTTP signatures

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account's normal role and repository permissions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea

CVE-2026-70396

Gitea organization repository creation token scope bypass

Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth application token without repository-write scope can therefore create organization-owned repositories if the authorizing user has permission to do so. This bypasses the token's delegated scope boundary while remaining subject to the user's organization permissions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea

CVE-2026-109665

Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation

Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to deactivate master records, modifying data beyond their permitted role.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Erpnext

CVE-2026-109660

Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records. An authenticated low-privileged user can send requests to these endpoints to modify production data beyond what their assigned role permits.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Erpnext

CVE-2026-109655

Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints

Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated low-privileged users can send requests to these endpoints to modify inventory records beyond their permitted role.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Erpnext

CVE-2026-109650

Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read personal data beyond what their assigned role permits.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Erpnext