CVE-2026-76142 Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface

Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions...

CVE-2026-76142 Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface

Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions...

EUVD-2026-90484

Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions...

CVE-2026-103534 David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control

A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/snapshots of the component Snapshot Model. This manipulation causes improper access controls. Remote exploitation of the attack is possibl...

PT-2026-104050

Name of the Vulnerable Software and Affected Versions RAGFlow version 0.24.0 Description Improper access control exists in the get dataset function within the 'api/apps/evaluation app' endpoint. This flaw allows an attacker to trigger the execution of arbitrary code or commands controlled by the...

CVE-2026-62073: Missing Authorization

Unauthenticated Broken Access Control in WP Full Stripe Free = 8.5.6 versions...

CVE-2026-51894

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via runmindmap. A reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object...

PT-2026-103806

Name of the Vulnerable Software and Affected Versions Ghost versions 5.3.0 through 6.57.0 Description Ghost fails to properly enforce access controls on comments when operating in private mode. This allows unauthenticated visitors to bypass privacy settings and read comments that should be...

PT-2026-103845

Authorization Bypass Through User-Controlled Key vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.0...

PT-2026-103895

Subscriber Broken Access Control in Gratisfaction = 4.6.3 versions...

CVE-2026-51895

Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

CVE-2026-51894: Undefined Security Weakness

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via runmindmap. A reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object...

CVE-2026-51893

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via tracemindmap. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object...

PT-2026-103882

Name of the Vulnerable Software and Affected Versions WP Full Stripe Free versions prior to 8.5.7 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a version newer than 8.5.6...

CVE-2026-51897

RAGFlow version 0.24.0 is affected by an improper access control vulnerability in the get_dataset() function located within the api/apps/evaluation_app endpoint. This flaw allows an attacker to trigger attacker-controlled code or command execution , depending on the exposed entry. As a temporary ...

CVE-2026-102382: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.0...

CVE-2026-51893

The infiniflow ragflow 0.24.0 software is vulnerable to Incorrect Access Control via the trace_mindmap function. An externally reachable path allows a caller to select an object or tenant identifier, which is then used in a data-access operation that lacks any visible owner, tenant, workspace, or...

PT-2026-104046

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace mindmap. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object...

CVE-2026-62063: Missing Authorization

Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.1...

CVE-2026-102370: On-Chip Debug and Test Interface With Improper Access Control

Kasa EC70 v4 and EC71 v4 do not logically disable the production debug interface at the firmware or chip level and do not lock the bootloader. Although the debug traces are physically severed during manufacturing, an attacker with physical access can restore the connection, interrupt the boot...