CVE-2026-110762
bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum post
CVSS
3.7
Baixa
EPSS
0.2%
p13
KEV
—
Exploit Today
4
0-100
Publicado: 14 de out. de 2026 · Última mod.: 15 de out. de 2026 · CWE-863
0.2%EPSS · 30 dias0.2%
2026-10-152026-11-06
bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility. Topics and replies in public subforums nested under private or hidden parents expose title, permalink and body via the BuddyPress activity stream and REST endpoint.
- bbpress.orghttps://bbpress.org/blog/2026/09/bbpress-2-6-19-is-out/
- github.comhttps://github.com/bbpress/bbPress/blob/04c6f1513c6ca34e849ca16015b7a08b3c15e753/src/includes/extend/buddypress/activity.php#L431
- github.comhttps://github.com/bbpress/bbPress/commit/5dce23a0b23a22d32c45b96fd44588952b16fe8a
- wordpress.orghttps://wordpress.org/plugins/bbpress/
- www.vulncheck.comhttps://www.vulncheck.com/advisories/bbpress-before-2.6.19-information-disclosure-via-buddypress-activity-stream
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-186894.3 MÉD—
———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.4hCVE-2026-173787.7 ALT—
———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.4hCVE-2026-173737.7 ALT—
———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.4hCVE-2026-173438.1 ALT—
———IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authorization checks to access or modify sensitive information due to improper authorization.4hCVE-2026-167115.3 MÉD—
———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to inject platform credentials into outbound requests due to improper input validation. A validation check is not sufficiently strict, which could cause platform credentials to be included in outbound requests.4hCVE-2026-1232189.8 CRÍ—
———IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.5h