CVE-2026-78581

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier t...

ROOT-OS-DEBIAN-12-CVE-2026-54370 CVE-2026-54370 in acl - Patched by Root

Root has patched CVE-2026-54370 in the acl package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-54369 CVE-2026-54369 in acl - Patched by Root

Root has patched CVE-2026-54369 in the acl package for Root:Debian:12. Multiple fixed versions available...

CVE-2026-56707 Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to...

CVE-2026-56707 Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to...

EUVD-2026-65205

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to...

PT-2026-81134

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to...

PT-2026-81309

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authorization bypass exists where an authenticated user can reference another user's AI Assistant conversation identifier to access or modify conversations they do not own. This occurs...

ROOT-OS-DEBIAN-13-CVE-2026-54370 CVE-2026-54370 in acl - Patched by Root

Root has patched CVE-2026-54370 in the acl package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-54369 CVE-2026-54369 in acl - Patched by Root

Root has patched CVE-2026-54369 in the acl package for Root:Debian:13. Multiple fixed versions available...

PT-2026-80974

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl general setup Edit ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this vulnerability via crafted input,...

PT-2026-80973

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl general setup Add ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this vulnerability via crafted input,...

CVE-2026-76607

Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik 4.7.2...

CVE-2026-76596

Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, a plain GET empties the target list's table...

CVE-2026-76596

Fabrik (Joomla extension by fabrikar.com) versions prior to 4.7.2 contain an unauthenticated table truncation vulnerability in the list.doempty endpoint. The list controller's doempty endpoints lack ACL gates , meaning a plain GET request from an unauthenticated attacker can empty the target list...

CVE-2026-76596 Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, a plain GET empties the target list's table...

CVE-2026-76596 Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, a plain GET empties the target list's table...

EUVD-2026-64319

Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik 4.7.3 - ???...

CVE-2026-76607 Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik 4.7.2...

CVE-2026-76607

Fabrik , a Joomla extension by fabrikar.com, is vulnerable to a missing ACL (Access Control List) check in its download element in versions prior to 4.7.3 . This flaw allows unauthenticated remote attackers to access download functionality without proper authorization, leading to high impact on c...