CVE-2026-96818: Missing Authorization

Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...

CVE-2026-96817: Missing Authorization

Subscriber Broken Access Control in MakeCommerce for WooCommerce = 4.1.0 versions...

CVE-2026-94074: Missing Authorization

Unauthenticated Broken Access Control in Simply Schedule Appointments = 1.6.12.29 versions...

CVE-2026-102582: Direct Request

A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing users with enrolment permissions to access the page directly by navigating to its URL. Consequently, an authorized user could manage manual enrolments...

EUVD-2026-90415

agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on tha...

PT-2026-103162

Unauthenticated Broken Access Control in Simply Schedule Appointments = 1.6.12.29 versions...

PT-2026-103202

Subscriber Broken Access Control in MakeCommerce for WooCommerce = 4.1.0 versions...

PT-2026-103251

Subscriber Broken Access Control in Prevent files / folders access = 2.6.7 versions...

PT-2026-103203

Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...

PT-2026-103230

Unauthenticated Broken Access Control in WordPress Backup & Migration = 1.6.0 versions...

CVE-2026-103105: Incorrect Authorization

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attacker with local access to a node within a Pexip Infinity installation to execute arbitrary code as an unprivileged user on another Pexip Infinity node...

PT-2026-103169

Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms = 2.7.2 versions...

PT-2026-103306

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.18991 Description Improper access control on the Gantt chart allows users with view-only permissions to perform edits. Recommendations Update to version 2026.2.18991...

CVE-2026-89190: Improper Access Control

The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages an...

CVE-2026-94120: Missing Authorization

Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms = 2.7.2 versions...

PT-2026-103616

agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on tha...

CVE-2026-75824: Improper Access Control

The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creating an account, allowing unauthenticated users to create accounts on sites where registration is disabled. The created account receives the site's default role...

PT-2026-103010

Name of the Vulnerable Software and Affected Versions Pexip Infinity versions prior to 38.2 Pexip Infinity version 39.0 Pexip Infinity version 39.1 Pexip Infinity version 40.0 Description Improper access control on a product-internal API allows an attacker with local access to a node within an...

PT-2026-103243

Unauthenticated Broken Access Control in Blocksy Companion = 2.1.55 versions...

CVE-2026-55181: Improper Access Control

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDCENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to...