PT-2026-49455

Unauthenticated Broken Access Control in AI Product Search for WooCommerce Motive Commerce Search = 1.38.2 versions...

PT-2026-49226

Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects MasterStudy LMS Pro: from n/a before 4.7.16...

PT-2026-49349

Subscriber Broken Access Control in bunny.net = 2.3.6 versions...

PT-2026-49227

Name of the Vulnerable Software and Affected Versions Really Simple SSL versions prior to 9.6.0 Description Broken Access Control allows users with the Subscriber role to perform unauthorized actions. Recommendations Update to a version newer than 9.5.9...

PT-2026-49481

Unauthenticated Broken Access Control in Montonio for WooCommerce = 10.1.2 versions...

PT-2026-49423

Unauthenticated Broken Access Control in WPAdverts = 2.3.0 versions...

PT-2026-49450

Subscriber Broken Access Control in Advanced Form Integration = 1.126.12 versions...

PT-2026-49445

Subscriber Broken Access Control in Classified Listing = 5.3.9 versions...

PT-2026-49234

Improper Access Control, Missing Authorization vulnerability in MIA Technology Inc. Pizzy Library allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pizzy Library: from 1.0.0.26250 before 1.3.9.26250...

PT-2026-49391

Unauthenticated Broken Access Control in Easy Appointments = 3.12.21 versions...

SUSE SLES15 Security Update : tomcat11 (SUSE-SU-2026:2374-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2374-1 advisory. This update for tomcat11 fixes the following issues Update to Tomcat 11.0.22: - CVE-2026-41284: Unbounded read in WebDAV LOCK and...

EUVD-2026-36625

OpenClaw before 2026.5.6 contains an improper access control vulnerability in Mattermost event handlers that fails to validate channel type metadata. Attackers can bypass intended DM policy decisions by sending crafted Mattermost events missing channel type information to process restricted conte...

Incorrect Authorization

Overview @openclaw/qqbot is an OpenClaw QQ Bot channel plugin for group and direct-message workflows. Affected versions of this package are vulnerable to Incorrect Authorization via the pre-dispatch process in QQBot slash commands. An attacker can bypass access control policies by invoking comman...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via the pre-dispatch process in QQBot slash commands. An attacker can bypass access control policies by invoking commands before the configured allowFrom checks ar...

CVE-2026-53837

OpenClaw before 2026.5.6 contains an improper access control vulnerability in Mattermost event handlers that fails to validate channel type metadata. Attackers can bypass intended DM policy decisions by sending crafted Mattermost events missing channel type information to process restricted conte...

CVE-2026-53828

OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in native command handling that allows authenticated senders to execute owner-only commands without proper policy enforcement. Attackers can trigger native command handling to bypass the configured owner-command access contro...

CVE-2026-46717

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, nezha's dashboard supports two user roles: RoleAdmin Role==0 and RoleMember Role==1. The notification routes POST /api/v1/notification and PATCH...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the dashboard process. An attacker can take control of all dashboard routing by claiming the Host through NAT as an authenticated user. Remediation Upgrade github.com/nezhahq/nezha/cmd/dashboard/controller to...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the dashboard process. An attacker can take control of all dashboard routing by claiming the Host through NAT as an authenticated user. Remediation Upgrade github.com/nezhahq/nezha/model to version 2.1.0 or...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the dashboard process. An attacker can take control of all dashboard routing by claiming the Host through NAT as an authenticated user. Remediation Upgrade github.com/nezhahq/nezha/service/singleton to version...