165125 matches found
CVE-2026-61487
Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination write ACL by sending to an ActiveMQ temporary composite destination whose physical name is a comma-separated composite of real...
CVE-2026-7187
Missing authentication for critical function vulnerability in Universal Software Inc. UKBS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects UKBS: through 28072026. NOTE: The vendor was contacted and it was learned that the product is not supported...
CVE-2026-7187
Missing authentication for critical function vulnerability in Universal Software Inc. UKBS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects UKBS: through 28072026. NOTE: The vendor was contacted and it was learned that the product is not supported...
CVE-2026-7187
The CVE-2026-7187 entry concerns Universal Software Inc. UKBS, affected through 2026-07-28 (through 28072026). Root cause: missing authentication for a critical function, allowing access to functionality not properly constrained by access control lists (ACLs). The issue targets the UKBS product a...
CVE-2026-18028
The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could use a well-timed reque...
CVE-2026-18028 Missing authorization check in event quick setup view
The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could use a well-timed reque...
WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Bao - BlueRock in WordPress Plugin Ultimate Store Kit Elementor Addons versions = 3.0.5...
CVE-2026-14926 FluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOR
The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any authenticated customer to act on another customer's subscription changing its payment method, or...
CVE-2026-16797 ShopLentor <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'optionSection' Parameter
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible...
EUVD-2026-49658
Unauthenticated Broken Access Control in Ad Invalid Click Protector AICP = 1.3.0 versions...
EUVD-2026-49668
Unauthenticated Broken Access Control in Xendit Payment = 7.1.0 versions...
PT-2026-65626
Name of the Vulnerable Software and Affected Versions goshs versions prior to 2.1.5 Description The sendFile function in the httpserver/handler.go file incorrectly derives the authorization filename from the raw req.URL.Path while opening the file using a cleaned path. This discrepancy allows an...
Kibana 9.4.x < 9.4.3 Multiple Vulnerabilities (ESA-2026-54 / ESA-2026-58)
The version of Kibana installed on the remote host is 9.4.x prior to 9.4.3. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-54 and ESA-2026-58 advisories. - Improper Access Control CWE-284 in Kibana can lead to unauthorized modification of Entity Analytics...
PT-2026-65598
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console...
PT-2026-65520
Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can...
CVE-2026-65445
Unauthenticated Broken Access Control in Ad Invalid Click Protector AICP = 1.3.0 versions...
CVE-2026-66473
Unauthenticated Broken Access Control in Xendit Payment = 7.1.0 versions...
CVE-2026-65445 WordPress Ad Invalid Click Protector (AICP) plugin <= 1.3.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Ad Invalid Click Protector AICP = 1.3.0 versions...