CVE-2026-85533

CVE-2026-85533 is an authorization bypass in MISP (Malware Information Sharing Platform). In attribute attachment/editing and Galaxy Cluster creation/editing workflows, the Sharing Group authorization check was only executed when the distribution field was explicitly set to 4. By omitting or mani...

CVE-2026-85533 MISP Sharing Group Authorization Bypass via Omitted Distribution Parameter

An authorization flaw in MISP allowed an authenticated user to submit a sharinggroupid without verifying that the user was authorized to use the referenced Sharing Group. In several attribute and Galaxy Cluster creation and editing workflows, validation of the submitted Sharing Group was performe...

EUVD-2026-70976

An authorization flaw in MISP allowed an authenticated user to submit a sharinggroupid without verifying that the user was authorized to use the referenced Sharing Group. In several attribute and Galaxy Cluster creation and editing workflows, validation of the submitted Sharing Group was performe...

BIT-JOOMLA-2026-73371 Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260808 - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform copy batch operations on uneditable items...

BIT-JOOMLA-2026-73337 Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2

Joomla! Core - 20260807 - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks...

CVE-2026-27432 WordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Rentals: from n/a before 3.16.0...

CVE-2026-27432

The WP Rentals WordPress theme by sc Internet Vivoo is affected by an Authorization Bypass Through User-Controlled Key vulnerability (classified as an Insecure Direct Object Reference / IDOR ) in versions before 3.16.0 . The flaw allows exploitation of incorrectly configured access control securi...

EUVD-2026-70975

Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Rentals: from n/a before 3.16.0...

CVE-2026-32480

CVE-2026-32480 affects the WCFM Membership WordPress plugin (by WC Lovers) in versions up to and including 2.11.11 . The vulnerability is a missing authorization (broken access control) flaw that allows exploitation of incorrectly configured access control security levels. The CVSS v3.1 score is ...

Improper Authorization

Spring Framework is vulnerable to Improper Authorization. The vulnerability is due to a header predicate bypass in pre-flight requests for WebFlux functional endpoints deployed with DispatcherServlet, allowing an attacker to bypass intended header-based restrictions...

CVE-2026-70403

XING CPTrans-ME-X contains a Use of Hard-coded Password CWE-259. Anyone with the knowledge of the credential may log in to the affected device...

CVE-2026-70403

XING CPTrans-ME-X contains a hard-coded password (CWE-259) that allows anyone who knows the credential to log in to the affected device. The vulnerability is rated CVSS 3.1: 9.8 CRITICAL (network vector, low complexity, no privileges or user interaction required) with high impact on confidentiali...

EUVD-2026-70906

The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the request, allowing unauthenticated users to make the site send emails to arbitrary recipients with an...

CVE-2026-79630

The WPFunnels WordPress plugin prior to 3.13.0 contains an unauthenticated price manipulation vulnerability in its checkout order-bump feature. The plugin fails to verify that the product ID submitted via an order bump matches the product for which the bump's discount was configured. An unauthent...

EUVD-2025-210844

The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when...

CVE-2026-78682

A flaw was found in NLTK. When an HTTP proxy is configured, a server-side request forgery SSRF vulnerability exists in the nltk.pathsec.urlopen function. An attacker can exploit this by providing a seemingly valid public URL, which the proxy then forwards to an internal service without proper...

kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC

A flaw was found in the Linux kernel's NFSv4 implementation. A local user could exploit a vulnerability where opening a file with OTRUNC truncate and ORDONLY read-only flags would bypass the necessary write permission checks. This oversight allows an attacker to truncate a file without having...

MasterHttpRelayVPN-RUST v1.9.37

mhrv-rs — bypass censorship for free, with your own Google account A small program that runs on your computer and lets you visit blocked websites for free, using a Google Apps Script you deploy in your own free Google account. Your ISP only sees encrypted traffic towww.google.com — it can't tell...

CVE-2026-85381

A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This issue affects some unknown processing of the file App/Home/Controller/ChapterController.class.php of the component Chapter Controller. Such...

CVE-2026-85381

light0011 CMS is affected by an authorization bypass in the Chapter Controller component (file App/Home/Controller/ChapterController.class.php). The root cause is manipulation of the content argument, which an unauthenticated remote attacker can exploit to bypass access controls. The impact is a ...