190317 matches found
CVE-2026-13043
A missing authentication vulnerability in the Kernel Memory Access Driver PSKMAD used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary privileged commands to the driver, resulting in disclosure of...
PYSEC-2026-4041 djust has broken object-level access control (IDOR)
Impact djust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated...
djust has broken object-level access control (IDOR)
Impactdjust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated us...
tomcat: Apache Tomcat: Security constraint bypass due to improper access control
A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potential...
tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing
A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve's N flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls...
CVE-2026-97277
Subscriber Broken Access Control in Social Boost = 3.6.2 versions...
CVE-2026-97281
Subscriber Broken Access Control in WP Project Manager = 4.0.7 versions...
CVE-2026-97297
Subscriber Broken Access Control in Gratisfaction = 4.6.3 versions...
CVE-2026-97280
Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0...
CVE-2026-97258
Subscriber Broken Access Control in Aruba Migration Tool = 1.0.4 versions...
CVE-2026-62073
Unauthenticated Broken Access Control in WP Full Stripe Free = 8.5.6 versions...
CVE-2026-97280
The Review Schema WordPress plugin (version 3.1.0 ) is vulnerable to a Missing Authorization flaw (CWE-862). This Broken Access Control vulnerability allows an attacker to exploit incorrectly configured access control security levels . The vulnerability impacts the integrity and availability of t...
CVE-2026-97280 WordPress Review Schema plugin 3.1.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0...
CVE-2026-97280 WordPress Review Schema plugin 3.1.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0...
EUVD-2026-90873
Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0...
Security Bulletin: IBM WebSphere Application Server Liberty prior to 26.0.0.9 is affected by multiple vulnerabilities
Summary IBM WebSphere Application Server Liberty prior to 26.0.0.9 is affected by multiple vulnerabilities. Vulnerability Details CVEID:CVE-2026-10841 DESCRIPTION: IBM WebSphere Application Server 8.5, 9.0, and Liberty are vulnerable to HTTP request smuggling. CWE:CWE-444: Inconsistent...
CVE-2026-97297 WordPress Gratisfaction plugin <= 4.6.3 - Broken Access Control vulnerability
Subscriber Broken Access Control in Gratisfaction = 4.6.3 versions...
CVE-2026-97297 WordPress Gratisfaction plugin <= 4.6.3 - Broken Access Control vulnerability
Subscriber Broken Access Control in Gratisfaction = 4.6.3 versions...