CVE-2026-110010

MB Custom Post Types & Custom Taxonomies 2.0.2 - 2.12.2 - Unauthenticated Settings Reset via 'mbcpt-force' Parameter

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentication check before allowing an unauthenticated request to re-run a legacy data migration, letting anyone revert a custom post type or taxonomy definition on sites upgraded from a pre-2.0 release back to its pre-upgrade state. This discards configuration changes an administrator made after upgrading and, where those changes had restricted a definition's visibility, silently re-exposes the definition and its content to anonymous visitors.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Deluxeblogtips Wordpress-extensions

Products

Mb Custom Post Types \& Custom Taxonomies Mb Custom Post Types & Custom Taxonomies

CVE-2026-110982

AI Engine < 3.8.6 - Editor+ Arbitrary Post Title and Excerpt Update via update_post_title and update_post_excerpt

The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as navigation menus, block templates, global styles and WooCommerce coupons.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Ai Engine

CVE-2026-84284

Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, 19.3 before 19.3.6, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read work item contents from private groups and projects due to incorrect authorization checks.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gitlab

Products

Gitlab

CVE-2026-91375

openjdk: Enhance jmod handling (Oracle CPU 2026-10)

Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N).

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Oracle

Products

Java Se Oracle Java Se

CVE-2026-109201

LogicalDOC Community Edition through 9.3 Missing Authorization in DocumentService

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore via SOAP or /services/rest/document with sequential document IDs to disclose, delete, or tamper with documents.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Logicaldoc

Products

Logicaldoc Logicaldoc Community Edition

CVE-2026-110108

MateCloud through 5.0.8 Missing Authorization via /api/v1/admin/storage API

MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage endpoints in StorageController. Low-privilege or self-registered users can supply arbitrary bucket and objectName values to list objects, obtain pre-signed download URLs for other users' files, delete objects, and upload at chosen keys.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Mateaix

Products

Matecloud

CVE-2026-110109

JetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Codec Save

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/{productId}. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec providers and configurations, controlling how transparent messages are decoded and encoded for every device of that product.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Jetlinks

Products

Jetlinks Community

CVE-2026-110131

ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints

ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id} endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or isDel=true query parameters to retrieve full titles, descriptions and content of non-public articles.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Liuyuyang01

Products

Thrivex-server

CVE-2026-114391

ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods

ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Easysoft

Products

Zentaopms

CVE-2026-86332

Odh-dashboard: odh-dashboard: nim credential secret readable by any authenticated user

A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard user can retrieve the cluster NVIDIA NGC API key Secret (apiKeySecret) and the NIM image pull secret (nimPullSecret). Create and delete of the same NIM credential are admin-gated; the read path is not. This is missing authorization (CWE-862) and insufficiently protected credentials (CWE-522). It is distinct from CVE-2026-5483 (service-account token leak in the Kubernetes client response wrapper on the same route) and CVE-2026-16456 (odh-model-controller cross-namespace confused deputy).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Red Hat Openshift Ai (rhoai) Openshift Ai

CVE-2026-39717

WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Thimpress Wordpress-extensions

Products

Learnpress Learnpress

CVE-2026-112293

BoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment API

BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the team_payments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link, create-checkout-session, and products to open Stripe billing portals, view invoices, change payment methods, or alter subscriptions.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Boxyhq

Products

Saas-starter-kit

CVE-2026-112268

sglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routes

sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/* endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped configuration, change global rate limits, and call POST /ha/shutdown to silently dissolve HA coordination.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sgl-project

Products

Sglang

CVE-2026-112000

Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs

Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and acknowledge its events, starve the legitimate consumer, and enumerate cluster users via ListUser.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Vanus-labs

Products

Vanus

CVE-2026-93428

Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view privacy-restricted member profile field values — including fields explicitly configured as owner-only, members-only, or role-restricted — by querying the publicly accessible wp_ajax_nopriv_um_get_members endpoint. The nonce required by the endpoint ('um-frontend-nonce') is emitted to all unauthenticated visitors via wp_localize_script, meaning it provides no meaningful access control and any anonymous visitor can satisfy the endpoint's authentication requirements.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ultimatemember Wordpress-extensions

Products

Ultimate Member Ultimate Member

CVE-2026-104675

WordPress Event Tickets plugin <= 5.30.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Liquid Web / Stellarwp Wordpress-extensions

Products

Event Tickets Event Tickets

CVE-2026-111921

Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion

Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier link shares because the delete permission check reads an unloaded share object. Attackers can send DELETE requests to the v1 or v2 projects shares endpoints with sequential share IDs to revoke admin links and invalidate existing share sessions.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Go-vikunja Vikunja

Products

Vikunja Vikunja

CVE-2026-111916

Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed

Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-restricted weblinks because rss/links.php omits the category_view role-visibility filter. Attackers can request the weblinks RSS feed for an organization to retrieve link names, URLs, descriptions, categories, and creator names from restricted LNK categories.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Admidio

Products

Admidio

CVE-2026-111910

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by bypassing per-record permission checks. Low-privileged users with the dlattachment right, or anonymous users when allowDownloadsForGuests is enabled, can request attachment IDs to retrieve confidential files from restricted FAQs.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Phpmyfaq Thorsten

Products

Phpmyfaq Phpmyfaq

CVE-2026-111900

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request index.php?action=attachment&id=<ID> to download complete attachment files belonging to draft FAQs.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Phpmyfaq Thorsten

Products

Phpmyfaq Phpmyfaq