CVE-2026-14488 Meta Box AIO <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'rwmb_frontend_field_object_id' Parameter

The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the templateredirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handlerequest function routing the mbfsdelete action without any capability or...

EUVD-2026-50237

Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated user, regardless of their assigned role, to perform administrative operations. Affect Version: This issue affects Apache Atlas: from 0.8 through...

CVE-2026-50622

Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated user, regardless of their assigned role, to perform administrative operations. Affect Version: This issue affects Apache Atlas: from 0.8 through...

CVE-2026-50622 Apache Atlas: Missing Authorization on Admin Endpoints

Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated user, regardless of their assigned role, to perform administrative operations. Affect Version: This issue affects Apache Atlas: from 0.8 through...

CVE-2026-50622

CVE-2026-50622 — Apache Atlas : A missing authorization vulnerability affects Atlas versions 0.8 through 2.5.0, where admin endpoints can be accessed by any authenticated user, enabling administrative operations. The issue stems from missing authorization checks on admin functions, potentially im...

CVE-2026-18207 Keycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching

A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by joining a group with a matching name in a...

EUVD-2025-210524

The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.37 vi the userfilter function. This makes it possible for unauthenticated attackers to create admin accounts...

CVE-2025-10656 Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Missing Authorization to Unauthenticated Privilege Escalation via Admin Account Creation

The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.37 vi the userfilter function. This makes it possible for unauthenticated attackers to create admin accounts...

EUVD-2026-50124

A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable...

CVE-2026-5626

The CVE affects the WordPress plugin “Survey Form Block” (versions up to and including 1.0.1). A missing capability check in get_all_data() enables authenticated users with Subscriber-level access and above to export all survey submissions and column metadata. Public exploit details are not provi...

CVE-2026-17166

The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an...

CVE-2026-17166

The CVE concerns The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar (WordPress) with an authorization bypass in all versions up to and including 5.3.7. The root cause is that the plugin does not properly verify that a user is authorized to perform ...

EUVD-2026-50098

The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an...

CVE-2026-17166

The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an...

PT-2026-65876

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to view the title of a confidential issue through a publicly accessible merge request d...

PT-2026-65875

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Maintainer role to modify protected branch configuration due to improper...

PT-2026-65878

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to bypass administrator-configured tool governance policies due to improper authorization enforcement during tok...

NewStart CGSL MAIN 6.06 : ipv6nat-selinux Multiple Vulnerabilities (NS-SA-2026-0054)

The remote NewStart CGSL host, running version MAIN 6.06, has ipv6nat-selinux packages installed that are affected by multiple vulnerabilities: - net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This...

PT-2026-65700

A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable...

PT-2026-65892

Name of the Vulnerable Software and Affected Versions Flyto2 Core versions prior to 2.26.6 Description The llm.chat function reads provider keys, such as OPENAI API KEY and ANTHROPIC API KEY, from the environment and transmits them within the Authorization: Bearer header to a base url controlled ...