191253 matches found
EUVD-2026-81277
In AVideo through 29.0, the API getapivideo endpoint contains a broken access control vulnerability in the cleantitle branch that returns user-group-restricted videos with owner PII to anonymous callers. Attackers can query videos by their public slug to bypass group restrictions and retrieve...
CVE-2026-74017: Missing Authorization
Unauthenticated Broken Access Control in User Registration = 5.2.7 versions...
SUSE SLES15: tomcat / tomcat-admin-webapps / tomcat-el-3_0-api / etc (SUSE-SU-2026:4203-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4203-1 advisory. - CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: Apache Tomcat: TOCTOU when...
CVE-2026-92915: Allocation of Resources Without Limits or Throttling
WWBN AVideo through commit e01e41ecc no patched version available contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement $global'ignoreUserMustBeLoggedIn' = 1, takes usersid directly from the query string, and calls User::sendVerificationLi...
CVE-2026-50610: Improper Access Control
A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense due to insufficient access controls in a privileged service. An authenticated local user may be able to access the service and perform unauthorized registry modifications,...
CVE-2026-50609: Improper Access Control
A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. Insufficient access controls within a privileged Named Pipe service may allow an authenticated local user to perform unauthorized registry operations. In certain situations, thi...
CVE-2026-91019: Improper Access Control
The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...
CVE-2026-90922: Improper Access Control
The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment before completing it, allowing unauthenticated users to obtain a paid membership by paying an arbitrary lower amount...
CVE-2026-61700: Improper Access Control
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processes a server-initiated LOCAL INFILE protocol packet 0xfb without enforcing allowLocalInfile=false. When an application sen...
CVE-2026-78528: Missing Authorization
Unauthenticated Broken Access Control in BerqWP = 4.1.15 versions...
CVE-2026-83944: Improper Access Control
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-74002: Missing Authorization
Unauthenticated Broken Access Control in Booking Calendar = 11.7 versions...
CVE-2026-66676: Missing Authorization
Unauthenticated Broken Access Control in Easy Invoice = 2.3.8 versions...
CVE-2026-50605: Improper Access Control
A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. Insufficient access controls within a privileged service may allow an authenticated local user to perform unauthorized registry operations. In certain situations, this could lead to...
PT-2026-94238
Name of the Vulnerable Software and Affected Versions WWBN AVideo through commit e01e41ecc Description A broken access control flaw exists in the 'objects/userVerifyEmail.php' endpoint. The script disables login requirements via the $global'ignoreUserMustBeLoggedIn' variable and accepts the users...
PT-2026-94284
Unauthenticated Broken Access Control in User Registration = 5.2.7 versions...
PT-2026-94288
Name of the Vulnerable Software and Affected Versions BerqWP versions prior to 4.1.16 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to version 4.1.16 or later...
PT-2026-94282
Name of the Vulnerable Software and Affected Versions Booking Calendar versions prior to 11.8 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass access restrictions. Recommendations Update to a version newer than 11.7...