[20260513] - Core - Privilege escalation through com_users batch task

An improper access check allows privlege escalation through the comusers batch task...

BIT-JOOMLA-2026-23899 Joomla! Core - [20260306] - Improper access check in webservice endpoints

An improper access check allows unauthorized access to webservice endpoints...

CVE-2026-35165 LORIS has incorrect access checks in document_repository

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. From 21.0.0 to before 27.0.3 and 28.0.1, while the documentrepository frontend was restricting file access, the backend endpoint was not...

Joomla! Multiple Vulnerabilities (20260302, 20260303, 20260304, 20260305, 20260306)

Joomla! is prone to multiple vulnerabilities. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

EUVD-2026-17863

An improper access check allows unauthorized access to webservice endpoints...

CVE-2026-23899

An improper access check allows unauthorized access to webservice endpoints...

CVE-2026-23899

An improper access check allows unauthorized access to webservice endpoints...

CVE-2026-23899

The CVE-2026-23899 entry concerns Joomla! Core with an improper access check in webservice endpoints that allows unauthorized access. Multiple connected sources confirm: a core vulnerability in Joomla! enables access to webservice endpoints by circumventing access checks (no user interaction requ...

CVE-2026-23899 Joomla! Core - [20260306] - Improper access check in webservice endpoints

An improper access check allows unauthorized access to webservice endpoints...

PT-2026-29506

Name of the Vulnerable Software and Affected Versions versions prior to 2026-23899 Description An improper access check allows unauthorized access to webservice endpoints. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...

PT-2026-29354

Name of the Vulnerable Software and Affected Versions PdfDing versions prior to 1.7.1 Description PdfDing is a selfhosted PDF manager, viewer and editor. Prior to version 1.7.1, the check shared access allowed function only validates session existence and does not check if a shared PDF is inactiv...

[20260306] - Core - Improper access check in webservice endpoints

An improper access check allows unauthorized access to webservice endpoints...

GHSA-V33R-R6H2-8WR7 Kimai's API invoice endpoint missing customer-level access control (IDOR)

Summary GET /api/invoices/id only checks the role-based viewinvoice permission but does not verify the requesting user has access to the invoice's customer. Any user with ROLETEAMLEAD which grants viewinvoice can read all invoices in the system, including those belonging to customers assigned to...

GHSA-RFPP-2HGM-GP5V Indico has a missing access check in the event series management API

Impact The API endpoint used to manage event series is missing an access check, allowing unauthenticated/unauthorized access to this endpoint. The impact of this is limited to: - Getting the metadata title, category chain, start/end date for events in an existing series - Deleting an existing eve...

CVE-2026-27954

Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52, three chat action endpoints holdaction.php, blockuser.php, and transferchat.php load chat objects by ID without calling erLhcoreClassChat::hasAccessToRead, allowing operators t...

Linux Distros Unpatched Vulnerability : CVE-2026-24095

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p21, 2.3.0 before 2.3.0p43, and 2.2.0 EOL allows users with the Use WATO permission to...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-004897)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004897 advisory. In the Linux kernel, the following vulnerability has been resolved: tee: add overflow check in registershmhelper With special lengths supplied by user space,...

CVE-2019-18674

An issue was discovered in Joomla! before 3.9.13. A missing access check in the phputf8 mapping files could lead to a path disclosure...

CVE-2019-16698

The directmail aka Direct Mail extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user with restricted permissions to the feusers table to view and export data of frontend users who are subscribed to a newsletter...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992851)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992851 advisory. In the Linux kernel, the following vulnerability has been resolved: tee: add overflow check in registershmhelper With special lengths supplied by user space,...