CVE-2026-120858

WordPress FluentForm plugin <= 6.2.16 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.16.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-109899

WordPress Melapress Role Editor plugin <= 1.3.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Melapress Role Editor: from n/a through 1.3.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-107616

Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Unauthenticated Arbitrary Event Attendee Data Exposure via '/report/event/attendees' Endpoint

The Amelia plugin for WordPress is vulnerable to unauthorized access of attendee data due to a missing authorization check on the GetEventAttendeesCommandHandler::handle() function in versions up to, and including, 9.9.1. The handler only enforces the broad `amelia_read_events` capability — which the plugin's own `wpamelia-customer` role possesses — and does not verify that the authenticated user is an organizer/provider of the event referenced by the client-supplied `id` query parameter. This makes it possible for authenticated attackers, with wpamelia-customer-level access and above, to export the full CSV of attendee personally identifiable information (first/last name, email, phone, date of birth, gender, private notes, payment amounts/methods, WooCommerce order IDs, custom-field values, and uploaded-file URLs) for any Amelia event on the site by directly invoking the `/report/event/attendees` endpoint with an arbitrary event ID.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-104992

Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Authenticated (Custom+) Sensitive Information Disclosure via '/report/event/bookings' Endpoint

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.9.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to export a full CSV of booking records for any event on the site — including attendee names, email addresses, phone numbers, booking status, number of persons, price, payment status, payment amount, and coupon codes — regardless of whether they own or participate in those events.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-77153

IBM i is Affected By Missing Authorization Vulnerability in Host-Based Printer Subsystem []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to obtain sensitive information from the Host-Based Printer Subsystem due to no authorization check. A bad actor could use this vulnerability to print files they should not be able to access.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-2477

Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 fails to enforce backend authorization checks, allowing low‑privileged users to directly invoke administrative API endpoints. This bypasses UI‑level access restrictions and may lead to unauthorized execution of privileged functions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Watsonx Orchestrate Cartridge For Cloud Pak For Data

CVE-2026-115718

Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt

Frappe Builder versions 1.33.0 before 1.36.0 contain a missing authorization vulnerability in the improve_prompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improve_prompt API to leverage the site owner's stored OpenRouter API key via resolve_api_key, consuming paid LLM credits and effectively turning the site into a free LLM proxy.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Builder

CVE-2026-124426

Craft CMS before 5.11.2 GraphQL Sites Scope Bypass via localized Field

Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows unauthenticated attackers to read content from sites outside a GraphQL schema's Sites scope. Attackers can send a POST request to /actions/graphql/api selecting the localized field without the siteId argument to disclose out-of-scope site content.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Craftcms

Products

Cms Craft Cms

CVE-2026-124427

Craft CMS 5.0.0 before 5.11.2 GraphQL Schema Scope Bypass via prev/next

Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows anonymous GraphQL clients to read out-of-scope section entries via prev/next fields. Attackers can chain next hops from one visible in-scope entry to enumerate entries and read titles, slugs, and custom-field content from withheld sections.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Craftcms

Products

Cms Craft Cms

CVE-2026-71959

Bitwarden Server < 2026.7.2 Audit Log Injection via POST /collect

Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to write forged, arbitrarily backdated entries into any organization's audit log.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Bitwarden

Products

Server

CVE-2026-56696

OpenHarness - Prompt Injection via /issue and /pr_comments Slash Commands

OpenHarness /issue and /pr_comments slash commands lack remote_invocable=False protection, allowing remote channel senders to write attacker-controlled Markdown into project context files. Admitted remote attackers can inject malicious content into .openharness/issue.md and .openharness/pr_comments.md files, which are subsequently injected into runtime system prompts, persistently influencing local agent behavior.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hkuds

Products

Openharness

CVE-2026-49948

Mem0 0.2.8 Missing Authorization via POST /configure Endpoint

Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability in the self-hosted server component where the POST /configure endpoint modifies global LLM provider and embedder configuration but only verifies authentication via JWT or X-API-Key without validating the caller's role. Any authenticated user holding a distributed API key can redirect all LLM and embedder traffic to an attacker-controlled server, with the malicious configuration persisted to PostgreSQL and surviving server restarts to affect all users and API keys on the instance.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Mem0ai

Products

Mem0

CVE-2026-124488

OpenEMR before 8.3.0 Authorization Bypass via load_form.php High-Sensitivity Encounters

OpenEMR before 8.3.0 contains an authorization bypass vulnerability that allows authenticated clinicians lacking high-sensitivity permission to read and modify encounter-bound forms via load_form.php. Attackers can request the Clinical Notes or Care Plan direct loader to obtain restricted content and a CSRF token, then submit save.php to tamper with clinical records.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124484

OpenEMR before 8.4.0 Missing Authorization in Portal Onsite-Document APIs

OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any authenticated core user to access cross-patient documents. Attackers can omit the patientId parameter and supply arbitrary record IDs to list, read, and overwrite other patients' portal documents, signatures, and template data.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124480

OpenEMR before 8.4.0 Authorization Bypass via FHIR QuestionnaireResponse APICSRFTOKEN

OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed api_csrf_token_js value to skip FHIR scope checks and call GET /fhir/QuestionnaireResponse, exfiltrating site-wide questionnaire answer PHI.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124477

OpenEMR before 8.3.0 Missing Authorization via delete_Recall in save.php

OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete arbitrary patient recall records via the delete_Recall action. Attackers can send POST requests to /interface/main/messages/save.php with a target pid and r_ID to remove recall data without ACL or ownership checks.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-124472

OpenEMR before 8.3.0 Missing Authorization via sl_eob_patient_note.php

OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_patient_note.php that allows any authenticated user to read and modify patient billing notes. Attackers with low-privilege accounts can enumerate the patient_id parameter and submit POST requests using the embedded CSRF token to view or tamper with confidential billing data.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2024-44006

WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in OnTheGoSystems WooCommerce Multilingual & Multicurrency woocommerce-multilingual.This issue affects WooCommerce Multilingual & Multicurrency: from n/a through 5.3.6.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Onthegosystems

Products

Woocommerce Multilingual \& Multicurrency

CVE-2026-19131

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow low-privileged users to query arbitrary indices and read sensitive data due to missing authorization.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Api Connect

CVE-2026-122663

WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerability

Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.20.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Villatheme Wordpress-extensions

Products

Curcy Curcy