CVE-2026-95527: Missing Authorization

Unauthenticated Broken Access Control in Conekta Payment Gateway = 6.2.4 versions...

PT-2026-97297

Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions prior to 12.8.711 ManageEngine Firewall Analyzer versions prior to 12.8.711 Description An issue exists where an authenticated low-privilege user can modify Change Management report schedule configurations for...

CVE-2026-91077: Improper Access Control

The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event...

PT-2026-97490

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1...

PT-2026-97448

Name of the Vulnerable Software and Affected Versions PayPlus Payment Gateway versions prior to 8.2.6 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a version newer than 8.2.5...

PT-2026-97477

Subscriber Bypass Vulnerability in WP User Frontend = 4.3.11 versions...

PT-2026-97454

Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...

CVE-2026-66070: Permissive Cross-domain Policy with Untrusted Domains

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...

PT-2026-97674

This module enables you to add mermaid diagram that displays either inline on an entity or optionally in a modal. The module doesn't sufficiently respect default revision behavior and does not properly limit access to the modal content. This vulnerability is mitigated by the fact that an attacker...

PT-2026-97558

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.17 RabbitMQ versions prior to 4.0.22 RabbitMQ versions prior to 4.1.13 RabbitMQ versions prior to 4.2.6 Description In the management plugin, the match origin/1 function within rabbit mgmt cors.erl incorrectly...

PT-2026-97494

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An improper access control issue exists in the '/api/v2/config/' endpoint, which is protected only by the IsAuthenticated permission. This allows any authenticat...

CVE-2026-95604: Missing Authorization

Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...

CVE-2026-90904: Improper Access Control

Joomla Extension - joomshaper.com - Broken Access Control ACL Bypass in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level ACL permission checks. Any authenticated...

PT-2026-97480

Unauthenticated Broken Access Control in Conekta Payment Gateway = 6.2.4 versions...

PT-2026-97492

Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...

Physalia: Redistribution-Resistant Content Protection for Decentralized Storage

In decentralized storage systems, access control is often implemented by encrypting the data before upload and sharing the decryption key with authorized parties. A leaked key, however, makes the data publicly accessible, which lowers the barrier to content piracy below that of traditional system...

CVE-2026-94080: Missing Authorization

Unauthenticated Broken Access Control in MarketKing = 2.1.70 versions...

PT-2026-97469

Subscriber Broken Access Control in Fluent Support = 2.3.2 versions...

CVE-2026-84791: Authorization Bypass Through User-Controlled Key

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope...

CVE-2026-77765: Improper Access Control

The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing unauthenticated users to pay an arbitrary reduced amount for a fixed-price item...