CVE-2026-57364 WordPress Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More plugin <= 2.2.0 - Other Vulnerability Type vulnerability

Improper Validation of Specified Quantity in Input vulnerability in WPDeveloper Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More better-payment allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Better Payment – Instant Payments,...

CVE-2026-57377 WordPress WowAddons plugin <= 1.6.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPXPO WowAddons product-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WowAddons: from n/a through = 1.6.8...

CVE-2026-57378 WordPress Advanced Forms plugin <= 1.9.3.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Phil Kurth Advanced Forms advanced-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Forms: from n/a through = 1.9.3.7...

CVE-2026-57390

The CVE concerns the WordPress plugin “Extra Product Options Builder for WooCommerce” (also listed as additional-product-fields-for-woocommerce). A Missing Authorization/Broken Access Control vulnerability affects the plugin in versions up to and including 1.2.167, enabling exploitation due to in...

CVE-2026-57364

The CVE-2026-57364 entry concerns the WordPress plugin WordPress Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More (better-payment) up to version 2.2.0. It describes improper validation of a specified quantity in input, leading to access to functionality not prop...

CVE-2026-57377

CVE-2026-57377 describes a missing authorization vulnerability in the WordPress WowAddons plugin (product-addons) affecting versions up to 1.6.8. The underlying issue is broken access control, i.e., incorrectly configured access control security levels, which can allow unauthorized actions. The v...

CVE-2026-12397 WP Job Portal < 2.5.5 - Subscriber+ Employer Email Disclosure via IDOR

The WP Job Portal WordPress plugin before 2.5.5 does not verify ownership when returning an employer's contact email for a given job, allowing authenticated users with a subscriber-level self-registerable account to read other employers' private account email addresses by enumerating job...

CVE-2026-12271

The CVE describes a vulnerability in the Tutor LMS WordPress plugin prior to 3.9.13 where the system does not verify ownership of the targeted quiz attempt before writing to it. This allows authenticated users with subscriber-level access and above to modify and force-complete other students’ qui...

CVE-2026-9492 GIGABYTE｜Gigabyte Control Center - Improper Access Control

The MBStorage DRAM lighting control module within Gigabyte Control Center GCC developed by GIGABYTE Technology has an Improper Access Control vulnerability. Authenticated local attackers can send specific IOCTL commands through the driver MyPortIOx64.sys bundled with the module, thereby arbitrari...

CVE-2026-9492

CVE-2026-9492 affects Gigabyte Control Center (GCC) MBStorage DRAM lighting control module. The vulnerability resides in the MyPortIO_x64.sys driver, where improper access control allows authenticated local attackers to issue IOCTL commands that can read and write physical memory, leading to kern...

CVE-2026-9492

The MBStorage DRAM lighting control module within Gigabyte Control Center GCC developed by GIGABYTE Technology has an Improper Access Control vulnerability. Authenticated local attackers can send specific IOCTL commands through the driver MyPortIOx64.sys bundled with the module, thereby arbitrari...

[SECURITY] Fedora 43 Update: acl-2.4.0-1.fc43

This package contains the getfacl and setfacl utilities needed for manipulating access control lists...

PT-2026-59362

Base Model Routing Bypasses Access Control via Model Chaining Affected Component Model chaining via base model id: - backend/open webui/routers/models.py lines 170-214, create new model - backend/open webui/routers/models.py lines 254-308, import models - backend/open webui/main.py lines 1696-171...

PT-2026-57768

Missing Authorization vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AcyMailing SMTP Newsletter: from n/a through = 10.11.1...

PT-2026-60064

Name of the Vulnerable Software and Affected Versions Decidim versions 0.31.1 through 0.31.4 Decidim version 0.32.0.rc1 Description An authorization bypass allows a normal participant to access the demographics questionnaire editor without the required administrator privileges. By directly loadin...

PT-2026-59571

Summary Type: Insecure Direct Object Reference. The issue CRUD endpoints GET / PATCH / DELETE /workspaces/workspace id/issues/issue id gate access on require workspace memberworkspace id only, then resolve issue id through IssueService.getissue id which is a primary-key lookup with no workspace...

PT-2026-57760

Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kirki: from n/a through = 6.0.13...

PT-2026-60067

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.30.9 Decidim versions 0.31.0 through 0.31.4 Decidim version 0.32.0.rc1 Description Identity-document verification admin controllers load pending authorization records using a raw identifier without verifying ownersh...

PT-2026-57762

Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flatsome: from n/a through = 3.20.5...

CVE-2026-51538

CVE-2026-51538 (OpENer 2.3.0) describes an Incorrect Access Control in encapsulation session handling. The server validates that a session_handle exists in the global list but does not verify that the handle belongs to the TCP connection issuing the request. With no strong binding between a sessi...