CVE-2026-84755

Mail Mint is a WordPress plugin affected by an unauthenticated Broken Access Control vulnerability in versions 1.31.0 and below . The flaw allows a remote attacker with no prior access to perform unauthorized actions on the plugin, resulting in low confidentiality and low integrity impact with no...

EUVD-2026-70587

Unauthenticated Broken Access Control in Mail Mint = 1.31.0 versions...

CVE-2026-84754

CVE-2026-84754 affects the WordPress WPFunnels plugin in versions ≤ 3.12.13 , where an unauthenticated broken access control flaw allows a remote attacker to manipulate integrity and availability of the target system without any user interaction. The CVSS 3.1 score is 6.5 (MEDIUM) with a vector o...

CVE-2026-84755 WordPress Mail Mint plugin <= 1.31.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Mail Mint = 1.31.0 versions...

CVE-2026-84238

CVE-2026-84238 affects the YITH Request a Quote for WooCommerce Premium WordPress plugin in versions prior to 4.46.0 . The vulnerability is an unauthenticated Broken Access Control flaw, meaning an attacker can exploit it over the network without any prior access or user interaction. The CVSS 3.1...

EUVD-2026-70563

Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium 4.46.0 versions...

CVE-2026-84238 WordPress YITH Request a Quote for WooCommerce Premium plugin < 4.46.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium 4.46.0 versions...

CVE-2026-84215

CVE-2026-84215 affects the WordPress Timetics plugin in versions 1.0.61 and earlier . The vulnerability is an unauthenticated Broken Access Control flaw, rated CVSS 6.5 (Medium) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. This means an unauthenticated network-based attacker can exploit ...

EUVD-2026-70591

Unauthenticated Broken Access Control in Timetics = 1.0.61 versions...

CVE-2026-84215 WordPress Timetics plugin <= 1.0.61 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Timetics = 1.0.61 versions...

CVE-2026-75035

A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user'...

CVE-2026-85226

MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution, sharing group, organization, or other access-control restrictions associated with the correlated attributes and events...

CVE-2026-85211

Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxyapi.py endpoints. Attackers can access other tenants' cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents...

CVE-2026-85214

vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial...

CVE-2026-75033

A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its field.cattle.io/projectId annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the...

EUVD-2026-70506

A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its field.cattle.io/projectId annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the...

CVE-2026-84989

ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717 , two REST v2 endpoints managing the tag/badge feature — POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua — perform no authorization check . Any authenticated non-administ...

EUVD-2026-70499

MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution, sharing group, organization, or other access-control restrictions associated with the correlated attributes and events...

CVE-2026-85226

CVE-2026-85226 affects the OnDemand correlation engine in MISP , a threat intelligence platform. Correlations were computed solely from matching attribute values without applying distribution, sharing-group, or organization-level access controls , allowing an authenticated low-privileged user to ...

CVE-2026-85226 MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations

MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution, sharing group, organization, or other access-control restrictions associated with the correlated attributes and events...