190782 matches found
CVE-2026-84791 Broken Access Control vulnerability
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope...
CVE-2026-84791
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below are affected by a Broken Access Control vulnerability. This flaw allows an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls that are outside of their assigned...
EUVD-2026-85260
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope...
CVE-2026-84791 Broken Access Control vulnerability
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope...
php: php: Access control bypass via partial IPv6 address comparison
A flaw was found in PHP. The access control check for Internet Protocol version 6 IPv6 addresses in the FastCGI implementation compares only the first 12 bytes of a 16-byte address instead of the complete address. An attacker on an adjacent network with an address sharing the first 96 bits with a...
WordPress AppMySite plugin <= 3.15.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by dodoh4t in WordPress Plugin AppMySite versions = 3.15.4...
WordPress Fluent Support plugin <= 2.3.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Brobicho in WordPress Plugin Fluent Support versions = 2.3.2...
WordPress WSP MCP - AI Agents Connector plugin <= 2.7.0 - Broken Access Control vulnerability
WordPress WSP MCP - AI Agents Connector plugin = 2.7.0 - Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WSP MCP AI Agents Connector versions = 2.7.0...
WordPress MarketKing plugin <= 2.1.70 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by JunHee CHO in WordPress Plugin MarketKing versions = 2.1.70...
CVE-2026-91077
The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event...
CVE-2026-84150
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with...
Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues due to Java SDK
Summary IBM Sterling Secure Proxy is affected by multiple vulnerabilities reported for IBM Java and are addressed in version 6.1.0.5 Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromis...
Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit users documents with duplicate keysfor 'roles' used for access control within the database, including the special case 'admin' role, th...
PT-2026-97490
Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1...
PT-2026-97577
Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 3.0.0 Description Improper access control allows unauthorized modification of application files. Recommendations At the moment, there is no information about a newer version that contains a fix for this...
CVE-2026-94498: Missing Authorization
Unauthenticated Broken Access Control in AppMySite = 3.15.4 versions...
CVE-2026-95527: Missing Authorization
Unauthenticated Broken Access Control in Conekta Payment Gateway = 6.2.4 versions...
CVE-2026-6718: Incorrect Default Permissions
IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files...
CVE-2026-82368: Improper Access Control
Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to communicate directly with backend management services. A local attacker can leverage this exposed access to transmit commands to connected Fabric OS switches...