WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.

WordPress AllAble Connector plugin <= 0.13.4 - Broken Access Control vulnerability

Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.

WordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions.

WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.

WordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion vulnerability

Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.

WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.

WordPress MakeCommerce for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions.

WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Bookly <= 28.2 versions.

WordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.

WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability

Subscriber Broken Access Control in FormGent <= 1.12.2 versions.

WordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.

WordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.

SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows

SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process (app/electron/main.js). The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows(), including windows belonging to other opened workspaces. A renderer connected to an attacker-controlled remote kernel can therefore send {cmd: "lockscreenByMode"} and have it delivered across the workspace boundary; a sibling workspace window whose lockScreenMode is set to 1 invokes lockScreen(). Repeated messages allow the remote workspace to repeatedly lock unrelated local workspace windows, causing a limited denial of service. No confidentiality, integrity, or code-execution impact was observed.

Cap-go capgo.app Authorization Bypass via channel_permission_overrides

Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing authenticated app/org admins to grant channel permissions to non-member users. Attackers with admin privileges can insert override rows with arbitrary external user UUIDs to grant channel-scoped permissions such as channel.promote_bundle to users outside the organization.

Flowise through 3.1.4 Missing Authorization via Chat Message Routes

Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys to read and delete chat history. Attackers with valid but low-privileged API keys can access GET and DELETE chat message routes without required flow permissions to read chat histories, prompts, model responses, and delete messages.

Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation

Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while creating a user because store() in app/Http/Controllers/Users/UsersController.php strips superuser permission but does not strip admin permission. The created account can obtain administrative privileges. This issue is fixed in version 8.6.0.

Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/{id} and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show() renders the record without authorize(), while company-scoped route-model binding only prevents access to other companies. Disclosed fields include asset tags, suppliers, purchase costs, notes, and dates. This issue is fixed in version 8.6.3.

An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the RTU500 to reboot through the reset endpoint. Successful exploitation could cause temporary device unavailability and disruption of its intended operation.

Lack of Authorization Allows Unrestricted Deletion or Restoration of Vault Attachments in Devolutions Server

Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently delete or restore vault attachments via a crafted API request.

Horilla: Missing Authorization on Payroll Component Views Exposes Employee Salary Structures and Personal Loan Records (IDOR)

Horilla is an HR and CRM software. In 1.5.0-85 and earlier, payroll/views/component_views.py does not consistently authorize access in allowances_deductions_tab, view_single_allowance, and view_single_deduction before loading records selected by emp_id, allowance_id, or deduction_id. An authenticated employee can substitute those identifiers to read another employee's salary structure, allowance and deduction amounts, personal loan disbursements, and repayment schedules without owning the record or holding payroll-view permissions. No complete fixed version is available as of this review.