CVE-2026-27366

CVE-2026-27366 concerns WordPress WordPress MainWP Child plugin versions

WordPress Subscriptions for WooCommerce plugin <= 1.9.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Jakub Herman in WordPress Plugin Subscriptions for WooCommerce versions = 1.9.5...

WordPress WPCafe plugin <= 3.0.14 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by L4m in WordPress Plugin WPCafe versions = 3.0.14...

EUVD-2026-39190

Generic IO & Memory Access driver for PCs provided by TOSHIBA CORPORATION and Dynabook Inc. exposes its IOCTL with insufficient access control. A logged-in user with no administrative privilege may access physical memory...

WordPress SEOPress PRO plugin <= 9.1.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by MD Shariful Islam in WordPress Plugin SEOPress PRO versions = 9.1.1...

CVE-2026-56129

Generic IO & Memory Access driver for PCs provided by TOSHIBA CORPORATION and Dynabook Inc. exposes its IOCTL with insufficient access control. A logged-in user with no administrative privilege may access physical memory...

WordPress Slim SEO plugin <= 4.6.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Abu Hurayra in WordPress Plugin Slim SEO versions = 4.6.2...

WordPress SiteGround Email Marketing plugin <= 1.7.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin SiteGround Email Marketing versions = 1.7.5...

Improper Authorization

Apache DolphinScheduler is vulnerable to Improper Authorization. The vulnerability is due to incorrect authorization checks when accessing workflow instance information, where users can retrieve workflow details from projects they are not authorized to access...

CVE-2026-56129

CVE-2026-56129 concerns a vulnerability in a Generic IO & Memory Access driver for PCs from Toshiba Corporation and Dynabook Inc. that exposes its IOCTL with insufficient access control. The flaw enables a logged-in user with no administrative privilege to access physical memory through the drive...

CVE-2026-56129

Generic IO & Memory Access driver for PCs provided by TOSHIBA CORPORATION and Dynabook Inc. exposes its IOCTL with insufficient access control. A logged-in user with no administrative privilege may access physical memory...

Improper Authorization

Apache DolphinScheduler is vulnerable to Improper Authorization. The vulnerability is due to incorrect authorization checks in the experimental /v2 interface, where insufficient access control allows attackers to perform unauthorized actions or access protected resources...

CVE-2026-5309

GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user to read or modify another group's virtual registry cleanup policy settings without...

PT-2026-71985

Name of the Vulnerable Software and Affected Versions go-chi chi versions 5.2.1 through 5.2.9 Description The RealIP middleware blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. This allows a remote attacker to supply a spoofed IP address in the X-Forwarded-For header to...

PT-2026-71987

Name of the Vulnerable Software and Affected Versions go-chi/chi versions 0.9.0 through 5.2.9 Description The RealIP middleware resolves the request source IP Request.RemoteAddr by using the first IP address found in the X-Forwarded-For header without validating trusted proxies. This allows a...

PT-2026-52396

Name of the Vulnerable Software and Affected Versions Dell Display and Peripheral Manager DDPM Windows versions prior to 2.3 Description An Improper Access Control issue exists where a low privileged attacker with local access could potentially achieve code execution. Improper Access Control occu...

PT-2026-52386

Name of the Vulnerable Software and Affected Versions MainWP Child versions prior to 6.1.2 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass access restrictions. Recommendations Update to a version newer than 6.1.1...

PT-2026-52415

Name of the Vulnerable Software and Affected Versions Five Star Restaurant Reservations versions prior to 2.7.20 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions and access restricted areas or functions of the...

PT-2026-52575

Name of the Vulnerable Software and Affected Versions Bitwarden Server versions prior to 2026.5.0 Description Broken access control allows any authenticated user to access arbitrary organization billing data. By supplying an arbitrary organizationId to the PreviewInvoiceController endpoints, an...

Vulnerability of the Core component of the Oracle WebCenter Content application: The Oracle WebCenter Content imaging platform for user interaction allows a perpetrator to gain unauthorized access to read, create, delete, and modify data.

Vulnerability of the Core component of the Oracle WebCenter Content application: The Imaging platform of Oracle WebCenter Content is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...