CVE-2026-129131

Gameyfin before 2.6.2 Missing Authorization in Hilla Endpoints

Gameyfin before 2.6.2 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass login-required mode by calling Hilla endpoints annotated with @AnonymousAllowed. Attackers can POST to synchronous endpoint methods such as GameEndpoint.sync, which LiveSubscriptionSecurity never checks, to retrieve game catalog metadata, libraries, platforms, plugins and game requests.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-127094

Pagelayer 2.1.7 before 2.2.1 Missing Authorization via Abilities API

Pagelayer 2.1.7 before 2.2.1 contains a missing authorization vulnerability in Abilities API abilities registered in main/abilitiesregister.php that only require the edit_posts capability. Contributor-level attackers can overwrite, publish, delete, or duplicate other users' private posts and pages to read them, and modify site-wide theme templates like headers and footers.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-126875

chromium-browser: chromium-browser: Web origin policy bypass via crafted HTML page

Missing authorization in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-125378

PowerDNS-Admin before 2026.11.0 Missing Authorization via Template Apply Endpoint

PowerDNS-Admin before 2026.11.0 contains a missing authorization vulnerability in the apply_records handler for /admin/template/<template>/apply that lets any authenticated User-role account modify shared zone templates. Attackers can replace a template's record set by name, injecting attacker-chosen NS, MX, A or CNAME records into every zone later created from it.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Powerdns-admin

Products

Powerdns-admin

CVE-2026-124267

WordPress Gmail SMTP plugin <= 1.2.3.23 - Broken Access Control vulnerability

Missing Authorization vulnerability in Noor Alam Gmail SMTP gmail-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gmail SMTP: from n/a through 1.2.3.23.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-121776

WordPress Passster plugin <= 4.3.20 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.20.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125858

WordPress CleverReach® WP plugin <= 1.5.26 - Broken Access Control vulnerability

Missing Authorization vulnerability in CleverReach CleverReach® WP cleverreach-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CleverReach® WP: from n/a through 1.5.26.

CVSS 3.1 · 6.3 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125853

WordPress Everest Backup plugin <= 2.3.14 - Broken Access Control vulnerability

Missing Authorization vulnerability in Everestthemes Everest Backup everest-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Backup: from n/a through 2.3.15.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125792

WordPress Church Admin plugin <= 5.1.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in Andy Moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through 5.1.8.

CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125834

WordPress Imagify plugin <= 2.3.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Media Imagify imagify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Imagify: from n/a through 2.3.4.

CVSS 3.1 · 4.3 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125827

WordPress Event Tickets plugin <= 5.31.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.31.0.

CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125810

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

CVSS 3.1 · 4.3 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125819

WordPress Gutenberg Blocks plugin <= 3.7.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenberg Blocks: from n/a through 3.7.6.

CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125808

WordPress HT Mega plugin <= 3.2.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in HTMega HT Mega ht-mega-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HT Mega: from n/a through 3.2.8.

CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-86779

Visualizer < 4.0.6 - Contributor+ Arbitrary Chart Deletion via deleteChart

The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including charts created by other users such as administrators.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Visualizer

CVE-2026-87797

Client Invoicing by Sprout Invoices < 20.8.16 - Subscriber+ Private Note Overwrite via si_edit_private_note

The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other users.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Sprout Invoices

CVE-2026-74933

GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every front-end page.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Geniewords

CVE-2026-81648

CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Cryptopayment Gateway

CVE-2026-88802

MDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post Deletion

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing unauthenticated attackers to destroy arbitrary posts, pages and media attachments, bypassing the trash.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Mdjm Event Management Mobile Events Manager

CVE-2026-82437

Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer

Description The Logviewer offers `logs.users` and `logs.groups` so operators can control who may read log content. For daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer whenever the flag was set, and the daemon log page and download endpoints reached the handler without consulting an authorizer at all. Any user able to pass the configured servlet filter could therefore read `nimbus.log`, `supervisor.log` and the other daemon logs on every reachable node, which contain other tenants' topology names, owners and configuration fragments. The same advisory covers the log listing endpoints, which accepted a user argument and never applied it, so `/listLogs` and `/searchLogs` returned every tenant's topology and worker log file names regardless of the caller. That part is metadata only. There was no configuration that closed either behaviour. Mitigation Upgrade to 3.1.0, where the daemon log paths evaluate the same configured user and group lists that the worker log paths already used, and the listing endpoints filter by the requesting user. Users who cannot upgrade immediately should place the Logviewer behind a reverse proxy that restricts the daemon log endpoints, and should treat daemon log content as readable by any filter-authenticated user. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apache Software Foundation

Products

Apache Storm Logviewer