CVE-2026-16561

Sunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure

The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Sunshine Photo Cart

CVE-2026-16603

Content Protector (Passster) < 4.3.6 - Unauthenticated Category-Locked Content Disclosure via Core REST API

The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Passster

CVE-2026-15246

RealHomes Memberships < 3.1.0 - Subscriber+ Membership Payment Bypass

The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages without paying.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Realhomes Memberships

CVE-2026-16965

Solace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebuilder_status

The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber (and, via CSRF, any logged-in user) to update post meta on arbitrary posts and to deactivate the site's active templates.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Solace Extra

CVE-2026-16992

Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication

The Create WordPress plugin before 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to make it publicly available.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Create

CVE-2026-18037

Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication

The Create WordPress plugin before 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to make it publicly available.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Create

CVE-2026-116468

Keycloak-services: keycloak-services: delegated admin escalates to realm-admin via group move

A flaw was found in the group-move and organization group reparenting endpoints of the keycloak-services component. This component is responsible for core authentication and authorization services in the Red Hat build of Keycloak. The issue occurs because the system fails to check if a target parent group confers administrative roles when a group is moved. A delegated administrator can exploit this to move a group they control under an administrative group, causing all members to inherit full realm-admin privileges and gain complete control over the realm.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Build Keycloak Red Hat Single Sign On

CVE-2026-124313

Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_payments_for_doc

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted get_linked_payments_for_doc method. Any authenticated user, including portal users, can supply arbitrary company, doctype, and docname values to read Payment Ledger Entry allocation data for other companies' invoices and vouchers.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Erpnext

CVE-2026-123623

Grida through 0.0.24 Missing Authorization in Forms File-Preview API

Grida through 0.0.24 contains a missing authorization vulnerability in the Forms file-preview API routes that allows unauthenticated attackers to read other organizations' form response files. Attackers can use form and field IDs exposed in public form payloads with a chosen path parameter to obtain service-role signed URLs for attachments and connected Supabase bucket objects.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-120857

WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.9.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-126561

Semantic MediaWiki 2.5.0 before 7.4.1 Missing Authorization via Is edit protected Annotation

Semantic MediaWiki 2.5.0 before 7.4.1 contains a missing authorization vulnerability that allows editors without the edit-protection right to lock pages by adding an Is edit protected annotation. Attackers can add [[Is edit protected::true]] to pages or #set it in widely transcluded templates, so the TitleQuickPermissions hook blocks other editors and administrators from editing, moving or deleting them indefinitely.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Semantic-mediawiki

Products

Semantic Mediawiki

CVE-2026-101792

Unauthorized Local Access to Oracle Communications BRM – Elastic Charging Engine Allows Data Modification

Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Security). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Communications BRM - Elastic Charging Engine executes to compromise Oracle Communications BRM - Elastic Charging Engine. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Communications BRM - Elastic Charging Engine accessible data as well as unauthorized read access to a subset of Oracle Communications BRM - Elastic Charging Engine accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N).

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Oracle

Products

Communications Billing And Revenue Management Elastic Charging Engine Communications Brm - Elastic Charging Engine

CVE-2026-9703

Viewer role can create, modify and delete Loki alerting rules

Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Because those rules are stored by Loki rather than by Grafana, the change took effect for every user of that Loki data source, not only for the Viewer who made the request. Exploitation requires an authenticated Viewer account on the Grafana instance and a configured Loki data source; no other privileges are needed. Both Grafana OSS and Grafana Enterprise are affected. The defect is in Grafana's data source proxy; Loki itself is not vulnerable and does not need to be patched.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Grafana

Products

Grafana Grafana Enterprise

CVE-2026-58408

ChurchCRM : Broken Access Control in `CSVCreateFile.php` Allows Low-Privileged Users to Export All Members' PII

ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privileged user can bypass the /admin/export UI and exfiltrate the entire member directory. The POST /CSVCreateFile.php endpoint generates and streams a CSV containing the full Personally Identifiable Information (PII) of every Person/Family record in the database, without performing any feature-level or object-level authorization check beyond the coarse "has any admin permission" gate inherited from the legacy page bootstrap. In other words, any single non-admin permission flag is enough to reach the CSV bulk-export endpoint, even though such users should not have data export rights. The export script is missing a dedicated isAdmin() (or a new bExportData) authorization check of its own. This issue has been fixed in version 7.4.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Churchcrm

Products

Churchcrm

CVE-2026-58410

ChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ records

ChurchCRM is an open-source church management system. Prior to version 7.4.0, there was an authorization flaw in the family-scoped endpoints which allowed low-privileged users to read and modify other families’ records. An authenticated non-admin user with EditSelf access can supply another family’s `familyId` and access records outside their own family scope. The backend trusts the attacker-controlled `familyId` and loads the corresponding family entity by ID without verifying that the requested family belongs to the current user. If the same user also has Notes permission, they can create notes on another family’s record. This breaks the intended EditSelf scope and allows access to unrelated congregation records. This issue has been fixed in version 7.4.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Churchcrm

Products

Churchcrm

CVE-2026-126545

WWBN AVideo through 29.7.1 Missing Authorization via get_api_tags API

WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::get_api_tags() in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored video_password values of unlisted, group-restricted and password-protected videos, enabling unauthorized viewing.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wwbn

Products

Avideo

CVE-2026-121101

chromium-browser: Missing authorization in DevTools

Published Prematurely

CVSS 3.1 · 4.3 Medium EPSS n/a KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-15248

Meta Box < 5.13.1 - Contributor+ Arbitrary Attachment Deletion via IDOR

The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Meta Box

CVE-2026-77191

All of the CVEs covered in this advisory apply to affected platforms running Arista EOS with 802.1X authentication and authorization enabled and Access Control Lists (ACLs) configured for per-supplicant policy enforcement. An authenticated supplicant on an

An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window (milliseconds to seconds) between the completion of the authentication phase and the full enforcement of its assigned ACL.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-94001

Keycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permission

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from resetting passwords, to delete a user's password credentials, resulting in the user being unable to log in.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Red Hat Build Of Keycloak 26.4 Build Keycloak Build Of Keycloak and 2 more