CVE-2026-62073: Missing Authorization

Unauthenticated Broken Access Control in WP Full Stripe Free = 8.5.6 versions...

PT-2026-103806

Name of the Vulnerable Software and Affected Versions Ghost versions 5.3.0 through 6.57.0 Description Ghost fails to properly enforce access controls on comments when operating in private mode. This allows unauthenticated visitors to bypass privacy settings and read comments that should be...

CVE-2026-51897

RAGFlow 0.24.0 contains improper access control in getdataset api/apps/evaluationapp. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

CVE-2026-62061: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid: from n/a through 6.0.0.2...

PT-2026-103844

Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.0...

CVE-2026-97281: Missing Authorization

Subscriber Broken Access Control in WP Project Manager = 4.0.7 versions...

CVE-2026-51893

The infiniflow ragflow 0.24.0 software is vulnerable to Incorrect Access Control via the trace_mindmap function. An externally reachable path allows a caller to select an object or tenant identifier, which is then used in a data-access operation that lacks any visible owner, tenant, workspace, or...

CVE-2026-51897: Undefined Security Weakness

RAGFlow 0.24.0 contains improper access control in getdataset api/apps/evaluationapp. Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution...

PT-2026-103852

Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.2...

PT-2026-103895

Subscriber Broken Access Control in Gratisfaction = 4.6.3 versions...

Rocky Linux 9.6 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc (ALMALINUX9.6:CLSA-2026:1768555539)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1768555539 advisory. - A flaw in libsoup's HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side...

CVE-2026-63045: Improper Access Control

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...

CVE-2026-63045: Improper Access Control

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...

Rocky Linux 8 [CIQ] Security Update: keepalived / keepalived-debuginfo / keepalived-debugsource (crlsa-2022_1930)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20221930 advisory. keepalived: dbus access control bypass CVE-2021-44225 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Nessu...

Rocky Linux 8 [CIQ] Security Update: pam / pam-debuginfo / pam-debugsource / pam-devel Multiple Vulnerabilities (crlsa-2024_10379)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202410379 advisory. pam: libpam: Libpam vulnerable to read hashed password CVE-2024-10041 pam: Improper Hostname Interpretation in pamaccess Leads to Access Control Bypass...

CVE-2026-51893

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via tracemindmap. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object...

PT-2026-103882

Name of the Vulnerable Software and Affected Versions WP Full Stripe Free versions prior to 8.5.7 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a version newer than 8.5.6...

PT-2026-104046

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace mindmap. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object...

CVE-2026-62063: Missing Authorization

Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.1...

CVE-2026-102370: On-Chip Debug and Test Interface With Improper Access Control

Kasa EC70 v4 and EC71 v4 do not logically disable the production debug interface at the firmware or chip level and do not lock the bootloader. Although the debug traces are physically severed during manufacturing, an attacker with physical access can restore the connection, interrupt the boot...