CVE-2026-76601

Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik 4.7.2 - The order plugin did not perform any access checks...

CVE-2026-76600

Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik 4.7.2 - The DeleteComment endpoint did not perform any access checks...

CVE-2026-77992 Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik 4.7.2 - The onUpdateComment endpoint did not perform any access checks...

CVE-2026-77992 Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik 4.7.2 - The onUpdateComment endpoint did not perform any access checks...

CVE-2026-76600

Fabrik (a Joomla extension by fabrikar.com) versions prior to 4.7.2 are affected by an unauthenticated comment deletion vulnerability. The DeleteComment endpoint performed no access checks, allowing any unauthenticated network attacker to delete any comment. The CVSS 4.0 base score is 6.9 (MEDIUM...

CVE-2026-76609 Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik 4.7.2 - The onUpdateComment endpoint did not perform any access checks...

CVE-2026-76608

Fabrik is a Joomla extension that provides form and database functionality. In versions prior to 4.7.2 , the onGetEmail endpoint lacked any access control checks, allowing an unauthenticated attacker to disclose the email address of any commenter. This constitutes an information disclosure vulner...

CVE-2026-34948

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3...

EUVD-2026-64187

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3...

CVE-2026-54624

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, renderobjectstructure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling usercanviewpage. Any staff account can request a restricted...

CVE-2026-62666

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey, generate2fa, and disable2fa omit the accessGrantsSuper target check used by sibling user mutation endpoints. A non-super account...

CVE-2026-73372

Joomla! Core - 20260809 - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2 - An improper access check injects contact information for unaccessible contact items into schema.org snippets...

PT-2026-77193

Name of the Vulnerable Software and Affected Versions Joomla! Core versions 4.0.0 through 5.4.7 Joomla! Core versions 6.0.0 through 6.1.2 Description An improper access check allows unauthorized users to perform mutation actions in webservice endpoints. This occurs because the Access Control List...

EUVD-2026-55972

Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are authorized to view the target comment. The vulnerable react handler passed an attacker-controlled commentid directly to...

CVE-2026-14197

The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted support agent to change the assigned customer of any ticket in the system, including tickets outside their granted scope...

CVE-2026-14197 Fluent Support < 2.3.1 - Agent+ Arbitrary Ticket Customer Reassignment via IDOR

The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted support agent to change the assigned customer of any ticket in the system, including tickets outside their granted scope...

CVE-2026-14310

CVE-2026-14310 affects the Tutor LMS WordPress plugin, version prior to 4.0.0. The vulnerability arises because the plugin does not properly verify that a user has access to the course associated with a Q&A thread before returning or writing to that thread. This enables authenticated users with s...

CVE-2026-64394

Summary: CVE-2026-64394 relates to the Linux kernel ksmbd SMB2 SET_INFO SECURITY path. The fix adds a per-handle access gate to prevent rewriting security descriptors when the handle lacks WRITE_DAC/WRITE_OWNER. Previously, SMB2_SET_INFO with InfoType SMB2_O_INFO_SECURITY could re-permission a fi...

EUVD-2026-42639

Open WebUI: Arena task endpoints can bypass underlying model access controls...

Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Summary The API endpoint DELETE /repos/owner/repo/issues/index/labels/id loads the label by ID with a global, unscoped lookup and never verifies the label belongs to the URL's repository or its owning organization. Because the response status differs by whether the label ID exists anywhere on the...