185179 matches found
CVE-2026-94679: Missing Authorization
Subscriber Broken Access Control in Fluent Support = 2.3.2 versions...
PT-2026-97480
Unauthenticated Broken Access Control in Conekta Payment Gateway = 6.2.4 versions...
CVE-2026-93529: Missing Authorization
Contributor Broken Access Control in WSP MCP – AI Agents Connector = 2.7.0 versions...
PT-2026-97473
Name of the Vulnerable Software and Affected Versions Online Booking & Scheduling Calendar for WordPress by vcita versions prior to 4.6.1 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a...
CVE-2026-95527: Missing Authorization
Unauthenticated Broken Access Control in Conekta Payment Gateway = 6.2.4 versions...
CVE-2026-94080: Missing Authorization
Unauthenticated Broken Access Control in MarketKing = 2.1.70 versions...
CVE-2026-77765: Improper Access Control
The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing unauthenticated users to pay an arbitrary reduced amount for a fixed-price item...
CVE-2026-91077: Improper Access Control
The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event...
CVE-2026-66070: Permissive Cross-domain Policy with Untrusted Domains
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...
Gitlab -- vulnerabilities
Gitlab reports: Double Free issue in Regular Expression Parser impacts GitLab CE/EE Integer Overflow issue in Regular Expression Compiler impacts GitLab CE/EE Cross-site Scripting issue in merge request diff viewer impacts GitLab CE/EE Missing Authorization issue in Duo AI job troubleshooting...
PT-2026-97174
Name of the Vulnerable Software and Affected Versions The Events Calendar WordPress plugin versions prior to 6.17.5 Description A broken access control issue exists where the software fails to verify the post status of linked records before including their stored details in a public REST API...
Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188
This module enables you to combine multiple image styles into a single image derivative. The module does not sufficiently validate image style names when generating image derivatives. Under certain circumstances, this allows anonymous users to generate image derivatives without a valid token,...
CVE-2026-84789: Authorization Bypass Through User-Controlled Key
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope...
FreeBSD : angie-module-njs -- multiple vulnerabilities (6cf326a2-b38c-11f1-a655-3497f65b111b)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 6cf326a2-b38c-11f1-a655-3497f65b111b advisory. The njs development team reports: Access control bypass in jsaccess when an asynchronous reque...
PT-2026-97296
Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions prior to 12.8.711 ManageEngine Firewall Analyzer versions prior to 12.8.711 Description An issue exists where an authenticated low-privilege user can bypass access controls to create alert notifications for...
PT-2026-97469
Subscriber Broken Access Control in Fluent Support = 2.3.2 versions...
PT-2026-97558
Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.17 RabbitMQ versions prior to 4.0.22 RabbitMQ versions prior to 4.1.13 RabbitMQ versions prior to 4.2.6 Description In the management plugin, the match origin/1 function within rabbit mgmt cors.erl incorrectly...
PT-2026-97490
Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1...