190773 matches found
CVE-2026-94080
Unauthenticated Broken Access Control in MarketKing = 2.1.70 versions...
CVE-2026-93620
Unauthenticated Broken Access Control in PayPlus Payment Gateway = 8.2.5 versions...
CVE-2026-93529
Contributor Broken Access Control in WSP MCP AI Agents Connector = 2.7.0 versions...
CVE-2026-90904
Joomla Extension - joomshaper.com - Broken Access Control ACL Bypass in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level ACL permission checks. Any authenticated...
CVE-2026-90905
Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=comeasystore&task=appconfig.updateConfiguration updated core Joomla mail configuration fromname, mailfrom in...
CVE-2026-76648
CopyAPIView awx/awx/api/generics.py:873 sets permissionclasses = IsAuthenticated,, so DRF's getobject performs no object-level RBAC. The get handler lines 988–991 explicitly guards with request.user.canaccessobj.class, 'read', obj — but post lines 1001–1010 does not. POST only checks:...
CVE-2026-76089
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level...
CVE-2026-63131
OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = "deny" for a LIST operation. When a parent path permitted LIST and a...
CVE-2026-90905 Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0
Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=comeasystore&task=appconfig.updateConfiguration updated core Joomla mail configuration fromname, mailfrom in...
CVE-2026-90905 Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0
Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=comeasystore&task=appconfig.updateConfiguration updated core Joomla mail configuration fromname, mailfrom in...
EUVD-2026-85556
Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=comeasystore&task=appconfig.updateConfiguration updated core Joomla mail configuration fromname, mailfrom in...
CVE-2026-90905
The Easy Store Joomla extension (versions 1.0.0-3.0.0 ) by joomshaper.com is vulnerable to a Cross-Site Request Forgery (CSRF) and a lack of Access Control on the administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration endpoint. The root cause is the failure to verify anti...
CVE-2026-90904
The Easy Store extension (versions 1.0.0-3.0.0 ) by joomshaper.com contains a Broken Access Control vulnerability. The allowEdit() method in ApiController.php hardcodes a return true; statement, which bypasses Joomla's component-level and asset-level ACL permission checks . This allows any authen...
EUVD-2026-85550
Joomla Extension - joomshaper.com - Broken Access Control ACL Bypass in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level ACL permission checks. Any authenticated...
EUVD-2026-85538
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level...
CVE-2026-76648
The Red Hat Ansible Automation Platform 2.7 (and its automation-controller) is vulnerable to a missing authorization check in the CopyAPIView component (located at awx/awx/api/generics.py:873). While the get() handler performs explicit read permission checks, the post() handler (lines 1001–1010) ...
EUVD-2026-85533
CopyAPIView awx/awx/api/generics.py:873 sets permissionclasses = IsAuthenticated,, so DRF's getobject performs no object-level RBAC. The get handler lines 988–991 explicitly guards with request.user.canaccessobj.class, 'read', obj — but post lines 1001–1010 does not. POST only checks:...
CVE-2026-86867
Cinnamon's Kotaemon all versions up to and including v0.12.0 multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and improper access controls. There are four handler methods in libs/ktem/ktem/pages/chat/control.py that load a Conversation record by its ID...