CVE-2026-15237

Hotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Motopress Hotel Booking Wordpress

Products

Motopress Hotel Booking Wordpress

CVE-2026-18035

User Access Manager < 2.3.15 - Unauthenticated Restricted Content Disclosure via REST API

The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

User Access Manager Project Wordpress

Products

User Access Manager Wordpress

CVE-2026-34184

Missing Authorization inAlanWeb SCADA

AlanWeb SCADA does not enforce authorization for some directories. This allows an unauthorized attacker to read all files in these directories and even execute some of them. Critically the attacker could run PHP scripts directly on the connected database. This issue was fixed in AlanWeb SCADA version 9.8.5

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Control System Hydrosystem Hydrosystem.poznan

Products

Alanweb Scada Control System Control System

CVE-2026-16608

Download Monitor < 5.2.6 - Unauthenticated Download Log Injection

The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Download Monitor Wordpress

Products

Download Monitor Wordpress

CVE-2026-69115

OpenIM Server v3.8.3 Missing Authorization on User and Group Enumeration Endpoints

OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/get_users, /user/get_all_users_uid, and /group/get_groups. Attackers can exploit the absent authverify.CheckAdmin() call in the GetPaginationUsers, GetAllUserID, and GetGroups handlers to enumerate all platform user accounts including userIDs, nicknames, and manager level flags, as well as all groups including private groups the user has never joined, exposing group names, owner IDs, and member counts.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Openimsdk

Products

Openim Server (open-im-server)

CVE-2026-73405

Authorization Bypass in SSE Pub/Sub Allows Unconfirmed Accounts to Access Stream Events in vulnerability-lookup

An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events (SSE) streams through the /pubsub/subscribe/<topic> endpoint. The token_required decorator used by the Pub/Sub interface authenticated requests solely by matching the X-API-KEY header against an existing user API key. Unlike the REST API authentication mechanism, it did not verify the account's is_active and is_confirmed state. Because the self-registration process issues an API key before account confirmation is completed, an attacker could create an account and immediately use the resulting API key to access Pub/Sub topics that should only be available to active, confirmed users. This could expose stream events that would otherwise be inaccessible through the REST API, including newly submitted or not-yet-moderated data such as comments. The vulnerability results from inconsistent authorization enforcement between the REST API and the SSE streaming interface. The patch corrects the issue by requiring accounts to be both active and confirmed before permitting access to Pub/Sub streams, bringing the SSE authorization boundary in line with the REST API.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Circl

Products

Vulnerability-lookup

CVE-2026-42142

TypeBot has Authorization Bypass in Google Sheets `getSheets` Endpoint that Allows Cross-Workspace Credential Access

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getSheets`) does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data (sheet names, IDs, column headers). Version 3.17.0 fixes the issue.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Baptistearno

Products

Typebot.io

CVE-2026-14548

Ray Enterprise Translation <= 1.7.3 - Subscriber+ Arbitrary API Token Update

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Lingotek-translation Wordpress

Products

Ray Enterprise Translation Wordpress

CVE-2026-14549

Ray Enterprise Translation <= 1.7.3 - Subscriber+ Language Addition and Deletion

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Lingotek-translation Wordpress

Products

Ray Enterprise Translation Wordpress

CVE-2026-18789

Ezoic < 2.23.1 - Unauthenticated Database Export via Content Export REST Routes

The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently change some of its settings.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ezoic Wordpress

Products

Ezoic Wordpress

CVE-2026-72883

Dokploy: WebSocket Terminal Missing Service-Level Access Control

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handlers in apps/dokploy/server/wss/terminal.ts, apps/dokploy/server/wss/docker-container-terminal.ts, apps/dokploy/server/wss/docker-container-logs.ts, and apps/dokploy/server/wss/docker-stats.ts validate organization membership but do not enforce checkServiceAccess, accessedServerIds, or accessedServices, allowing an authenticated organization member to obtain root terminal access and read logs or statistics for restricted servers and services. This issue is fixed in version 0.29.13.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Dokploy

Products

Dokploy

CVE-2026-47226

Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges

Admidio is an open-source user management solution. Prior to version 5.0.10, an authenticated Admidio member with upload rights on any one folder can permanently delete files from folders where they have only view access. The authorization check at the top of `modules/documents-files.php` evaluates upload rights against the attacker-supplied `folder_uuid` URL parameter — not the file's actual parent folder. The `file_delete` handler then only verifies view rights on the file's real location, never upload rights. By passing a folder they legitimately own in `folder_uuid` while targeting a file in a restricted folder via `file_uuid`, an attacker bypasses the upload-right check entirely and permanently deletes the file. This is an incomplete fix of GHSA-rmpj-3x5m-9m5f, which was patched in v5.0.7 but remains exploitable in v5.0.9. User should upgrade to v5.0.10 to receive an updated fix.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Admidio

Products

Admidio

CVE-2026-65926

Private Release Bundle versions may be disclosed under specific configurations

An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-19539

IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion

Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CRM before 5.4.9 allows authenticated users of any company to read the full content (title, description, and attachments) of tickets belonging to another company, to hijack another company's tickets by reassigning their company_id, and to delete another company's tickets without any authorization check, via the ticket's numeric identifier, because the read and save operations retrieve the record without constraining the query to the authenticated user's company, and the delete controller type-hints a generic Illuminate\Http\Request instead of the TicketDeleteRequest that would enforce the required permission.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Roskus

Products

Prospero Flow Crm

CVE-2026-14886

Vault Enterprise vulnerable to cross-namespace entity deletion

Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This vulnerability (CVE-2026-14886) is fixed in Vault Enterprise 2.0.4, 1.21.9, 1.20.14 and 1.19.20.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Hashicorp

Products

Vault Enterprise

CVE-2024-32532

WordPress Speed Optimizer plugin <= 7.4.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in SiteGround Speed Optimizer.This issue affects Speed Optimizer: from n/a through 7.4.6.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Siteground Wordpress

Products

Speed Optimizer Wordpress

CVE-2024-32518

WordPress PeproDev Ultimate Invoice plugin <= 2.0.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Pepro Dev. Group PeproDev Ultimate Invoice.This issue affects PeproDev Ultimate Invoice: from n/a through 2.0.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2023-44227

WordPress Simple File List Plugin <= 6.1.9 is vulnerable to Arbitrary File Deletion

Missing Authorization vulnerability in Mitchell Bennis Simple File List.This issue affects Simple File List: from n/a through 6.1.9.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-65806

Azure CycleCloud Information Disclosure Vulnerability

Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Cyclecloud

CVE-2026-70340

Azure CycleCloud Elevation of Privilege Vulnerability

Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Cyclecloud