CVE-2026-105706

SourceCodester Drug Recommendation System cross-site request forgery

A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected is an unknown function. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sourcecodester

Products

Drug Recommendation System

CVE-2026-105693

Penpot: Anonymous share-link token disclosure & page-scope bypass via get-view-only-bundle

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link. A holder of a restrictive link can obtain other links' secret IDs, page scopes, comment permissions, and inspection permissions, then replay a more permissive token to access page data that was not included in the original share. This issue is fixed in version 2.18.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Penpot

Products

Penpot

CVE-2025-62973

WordPress BuddyForms plugin <= 2.10.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Themekraft BuddyForms buddyforms allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BuddyForms: from n/a through 2.10.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Themekraft Wordpress

Products

Buddyforms Wordpress

CVE-2026-97309

WordPress RepairBuddy plugin <= 4.1226 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-97303

WordPress Scratch & Win – Giveaways and Contests plugin <= 3.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scratch & Win – Giveaways and Contests: from n/a through 3.0.2.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-39789

WordPress Fluent Affiliate Pro plugin <= 1.6.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-39749

WordPress App for Cloudflare® plugin <= 1.10.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-39599

WordPress WDS MCP Content Manager plugin <= 3.10.4 - Broken Access Control vulnerability

Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-32578

WordPress ECPay Ecommerce for WooCommerce plugin <= 1.1.2606090 - Broken Access Control vulnerability

Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-25433

WordPress WP2LEADS plugin <= 3.5.7 - Broken Access Control vulnerability

Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-105072

WordPress FluentBooking Pro plugin < 2.5.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-104386

WordPress WP VR plugin <= 9.1.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through 9.1.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-103337

WordPress WC Ukraine Shipping plugin <= 1.23.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Ukraine Shipping: from n/a through 1.23.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-103086

WordPress UsersWP plugin <= 1.2.74 - Broken Access Control vulnerability

Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.74.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-103762

SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints

SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read-only publish visitors to learn unpublished notebook box IDs. Attackers with read-only or anonymous publish access can POST any open notebook ID to receive the global save-box ID and save-path template, revealing a hidden notebook's existence and creation time.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

B3log Siyuan

Products

Siyuan Siyuan

CVE-2026-105695

Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile. An authenticated user who obtains another user's live, completed upload-session UUID can assemble the victim's chunks into the attacker's own file, team font, or project import, disclosing the uploaded bytes and deleting the victim's pending session. This issue is fixed in version 2.18.0.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Penpot

Products

Penpot

CVE-2026-105209

ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one organization can obtain an enrollment code for a user in another organization on the same instance and register their own authenticator to take over that account.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Zitadel

Products

Zitadel

CVE-2026-104979

Plane: Cross-tenant stored XSS in intake enables account takeover

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description_html through Issue.objects.create(...) without calling validate_html_content from nh3. Any authenticated user, including a new user with no workspace memberships, can plant arbitrary HTML in a project that has a published DeployBoard with intake enabled. When a project member or viewer of a closed intake item clicks the planted link, the TipTap \tjavascript: parser bypass and the target="_self" click handler execute JavaScript in the viewer's session and exfiltrate a long-lived API token. This issue is fixed in 1.4.0.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Makeplane

Products

Plane

CVE-2026-104968

Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/entity-search/?query_type=user_mention returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even when the caller is not a workspace member. The endpoint also exposes ProjectMember rows under the same condition. SearchEndpoint in apps/api/plane/app/views/search/base.py inherits BaseAPIView with only permission_classes = [IsAuthenticated] and performs no workspace-membership check. This issue is fixed in 1.4.0.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Makeplane

Products

Plane

CVE-2026-104971

Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization

Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication. WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint omit workspace authorization, allowing authenticated users to read, create, modify, or delete assets in workspaces where they are not members. Separately, WorkspaceViewViewSet.retrieve lacks the authorization decorator used by its sibling actions, exposing an unauthorized workspace-view read surface. This issue is fixed in 1.4.0.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Makeplane

Products

Plane