CVE-2026-71365

A server-side request forgery SSRF vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL pullrequest.statusesurl from the incoming webhook payload without validating the target host against the expect...

CVE-2026-49223 Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/productreview.sql queries accept ...

CVE-2026-49223

Vvveb CMS (versions before 1.0.8.4) has an authorization bypass in admin/sql/sqlite/product_review.sql, which accepts a caller-controlled product_review_id without verifying ownership against the current admin's admin_id. A low-privileged Vendor can read, edit, approve, or delete reviews under an...

CVE-2026-49223 Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/productreview.sql queries accept ...

CVE-2026-49224 Vvveb post revision authorization bypass allows Authors to read, restore, or delete other Authors' post revisions

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author. The admin/controller/content/revisions.php controll...

CVE-2026-49224

CVE-2026-49224 is an authorization bypass in Vvveb CMS (prior to 1.0.8.4) affecting post revision operations. The admin/controller/content/revisions.php controller and admin/sql/sqlite/post_content_revision.sql queries trust caller-controlled post_id, language_id, and created_at values without co...

CVE-2026-49224 Vvveb post revision authorization bypass allows Authors to read, restore, or delete other Authors' post revisions

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author. The admin/controller/content/revisions.php controll...

CVE-2026-49222

In Vvveb versions before 1.0.8.4, the admin/sql/sqlite/product_question.sql queries accept a caller-controlled product_question_id without verifying that product_question.product_id belongs to the current vendor's admin_id. A low-privileged vendor can read, approve, edit, or delete questions unde...

CVE-2026-49222 Vvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors' products

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow a low-privileged Vendor to manage questions under another Vendor's products. The admin/sql/sqlite/productquestion.sql queries...

CVE-2026-49222 Vvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors' products

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow a low-privileged Vendor to manage questions under another Vendor's products. The admin/sql/sqlite/productquestion.sql queries...

CVE-2026-49225 Vvveb product revision authorization bypass allows Vendors to read, restore, or delete other Vendors' product revisions

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor. The admin/controller/product/revisions.php...

CVE-2026-49225

CVE-2026-49225 is an authorization bypass in Vvveb (a CMS with page builder) prior to version 1.0.8.4 . The product revision endpoint (admin/controller/product/revisions.php) reuses the content revision controller, and the underlying SQL layer (product_content_revision.sql) trusts caller-supplied...

CVE-2026-49225 Vvveb product revision authorization bypass allows Vendors to read, restore, or delete other Vendors' product revisions

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor. The admin/controller/product/revisions.php...

CVE-2026-49228 Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' products

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The admin/controller/product/products.php controller accepts a...

CVE-2026-49228

In Vvveb before 1.0.8.4, admin/controller/product/products.php accepts a caller-controlled product_id for duplicate and delete actions, and admin/sql/sqlite/product.sql fails to consistently enforce the current admin_id when view_other_products or edit_other_products is absent, allowing a low-pri...

CVE-2026-49228 Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' products

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The admin/controller/product/products.php controller accepts a...

CVE-2026-73371 Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260808 - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform copy batch operations on uneditable items...

EUVD-2026-61025

Joomla! Core - 20260803 - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI...

EUVD-2026-61024

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filteradminid to...

CVE-2026-49226

Vvveb's admin/controller/content/posts.php lets low-privileged Authors override admin_id filters and supply caller-controlled post_id values for duplicate/delete actions, while admin/sql/sqlite/post.sql inconsistently enforces post.admin_id. This enables cross-author post viewing, duplication, de...