PYSEC-2026-677 MoinMoin Improper Access Control

macroGetval in wikimacro.py in MoinMoin 1.5.8 and earlier does not properly enforce ACLs, which allows remote attackers to read protected pages. The issue has been fixed on 4a7de0173734...

PYSEC-2026-675 MoinMoin Improper ACL handling for calendars and includes

MoinMoin before 20070507 does not properly enforce ACLs for calendars and includes, which allows remote attackers to read certain pages via unspecified vectors...

PYSEC-2026-674 MoinMoin Improper Privilege Management

MoinMoin 1.2.2 and earlier could allow a remote attacker to gain elevated privileges, caused by an undisclosed Access Control List ACL vulnerability in the PageEditor...

PYSEC-2026-680 MoinMoin Improper Access Control

Unknown vulnerability in MoinMoin 1.2.2 and earlier allows remote attackers to gain unauthorized access to administrator functions such as 1 revert and 2 delete...

Microsoft Azure Synapse Elevation of Privilege Vulnerability

Improper access control in Azure Synapse allows an authorized attacker to elevate privileges over a network...

GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward

Summary The BalancerForward proxy helper in GoFiber uses Header.Add instead of Header.Set when injecting the X-Real-IP header. This appends the real client IP as a second header value rather than replacing any attacker-supplied value. Upstream servers that read the first X-Real-IP header nginx,...

CVE-2026-4767

Technical details (affected product/version, root cause, impact, or remediation) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2026-57760

Missing Authorization vulnerability in Sendcloud Sendcloud Shipping allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sendcloud Shipping: from n/a through 1.0.29...

CVE-2026-57750

Unauthenticated Broken Access Control in ez Form Calculator Premium = 2.14.1.2 versions...

CVE-2026-57746

Subscriber Broken Access Control in Booked = 3.0.0 versions...

CVE-2026-57731

Contributor Broken Access Control in Flatsome = 3.20.5 versions...

CVE-2026-57685

Subscriber Broken Access Control in Martfury - WooCommerce Marketplace WordPress Theme = 3.2.8 versions...

CVE-2026-57688

Unauthenticated Broken Access Control in POS Entegratör = 3.7.103 versions...

CVE-2026-57669

Subscriber Broken Access Control in Advanced Contact form 7 DB = 2.0.9 versions...

CVE-2026-57355

Subscriber Broken Access Control in Classified Listing = 5.4.2 versions...

CVE-2026-57353

Subscriber Broken Access Control in Link Whisper Premium = 2.9.0 versions...

CVE-2026-39448

Unauthenticated Broken Access Control in NOWPayments for WooCommerce = 1.4.0 versions...

CVE-2026-27433

Unauthenticated Broken Access Control in Motors = 5.6.80 versions...

CVE-2025-66076

Unauthenticated Broken Access Control in Woostify Sites Library = 1.6.2 versions...

WordPress Universal Clocks plugin <= 1.2.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Universal Clocks versions = 1.2.0...