EUVD-2026-90667

Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read comments that should be restricted, bypassing privacy settings...

CVE-2026-103274

Ghost versions 5.3.0 before 6.58.0 are vulnerable to an unauthenticated comment read vulnerability. The application fails to properly enforce access controls on comments when the site is in private mode , allowing unauthenticated visitors to read restricted comments and bypass intended privacy se...

CVE-2026-103274 Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read

Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read comments that should be restricted, bypassing privacy settings...

BIT-KIBANA-2026-78582 Missing Authorization in Kibana Leading to Unauthorized Deletion of Data

Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that a...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Jul 2026 - Includes Oracle July 2026 CPU plus four additional vulnerabilities for Rational Software Architect Designer

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition,Versions 8 , Java 17 and Java 21 that are used by Rational Software Architect Designer and Rational Software Architect Designer for Websphere Software. These issues were disclosed as part of the IBM SDK, Java Technolo...

Armatura LLC Armatura One

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to the database, execute arbitrary code on the host with the highest level of privilege, or gain control of the physical access-control system. 2. RECOMMENDED PRACTICES CISA...

CVE-2026-76142

Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions...

CVE-2026-76142

The Genian NAC/ZTNA policy server is vulnerable to improper access control due to insufficient authentication on its internal-only IPC SOAP endpoint . An unauthenticated attacker can exploit this flaw to invoke internal functions, potentially leading to high impact on integrity and availability ....

CVE-2026-76142 Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface

Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions...

CVE-2026-76142 Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface

Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions...

EUVD-2026-90484

Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions...

CVE-2026-103534 David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control

A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/snapshots of the component Snapshot Model. This manipulation causes improper access controls. Remote exploitation of the attack is possibl...

PT-2026-104050

Name of the Vulnerable Software and Affected Versions RAGFlow version 0.24.0 Description Improper access control exists in the get dataset function within the 'api/apps/evaluation app' endpoint. This flaw allows an attacker to trigger the execution of arbitrary code or commands controlled by the...

PT-2026-103887

Name of the Vulnerable Software and Affected Versions Aruba Migration Tool versions prior to 1.0.5 Description Broken access control allows subscribers to bypass intended security restrictions. Recommendations Update Aruba Migration Tool to version 1.0.5 or later...

CVE-2026-62073: Missing Authorization

Unauthenticated Broken Access Control in WP Full Stripe Free = 8.5.6 versions...

CVE-2026-103341: Missing Authorization

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elementor Free Widgets,...

CVE-2026-51894

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via runmindmap. A reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object...

CVE-2026-51895: Improper Access Control

Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

PT-2026-103806

Name of the Vulnerable Software and Affected Versions Ghost versions 5.3.0 through 6.57.0 Description Ghost fails to properly enforce access controls on comments when operating in private mode. This allows unauthenticated visitors to bypass privacy settings and read comments that should be...

PT-2026-103845

Authorization Bypass Through User-Controlled Key vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.0...