CVE-2026-91019: Improper Access Control

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...

CVE-2026-74000: Missing Authorization

Contributor Broken Access Control in Simple Membership = 4.8.2 versions...

CVE-2026-83944: Improper Access Control

Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-78528: Missing Authorization

Unauthenticated Broken Access Control in BerqWP = 4.1.15 versions...

CVE-2026-66676: Missing Authorization

Unauthenticated Broken Access Control in Easy Invoice = 2.3.8 versions...

PT-2026-94284

Unauthenticated Broken Access Control in User Registration = 5.2.7 versions...

CVE-2026-74002: Missing Authorization

Unauthenticated Broken Access Control in Booking Calendar = 11.7 versions...

CVE-2026-50610: Improper Access Control

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense due to insufficient access controls in a privileged service. An authenticated local user may be able to access the service and perform unauthorized registry modifications,...

CVE-2026-92915: Allocation of Resources Without Limits or Throttling

WWBN AVideo through commit e01e41ecc no patched version available contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement $global'ignoreUserMustBeLoggedIn' = 1, takes usersid directly from the query string, and calls User::sendVerificationLi...

PT-2026-94238

Name of the Vulnerable Software and Affected Versions WWBN AVideo through commit e01e41ecc Description A broken access control flaw exists in the 'objects/userVerifyEmail.php' endpoint. The script disables login requirements via the $global'ignoreUserMustBeLoggedIn' variable and accepts the users...

CVE-2026-74017: Missing Authorization

Unauthenticated Broken Access Control in User Registration = 5.2.7 versions...

CVE-2026-50609: Improper Access Control

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. Insufficient access controls within a privileged Named Pipe service may allow an authenticated local user to perform unauthorized registry operations. In certain situations, thi...

SUSE SLES15: tomcat / tomcat-admin-webapps / tomcat-el-3_0-api / etc (SUSE-SU-2026:4203-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4203-1 advisory. - CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: Apache Tomcat: TOCTOU when...

PT-2026-94278

Unauthenticated Broken Access Control in Easy Invoice = 2.3.8 versions...

PT-2026-94281

Contributor Broken Access Control in Simple Membership = 4.8.2 versions...

PT-2026-94288

Name of the Vulnerable Software and Affected Versions BerqWP versions prior to 4.1.16 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to version 4.1.16 or later...

CVE-2026-61700: Improper Access Control

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processes a server-initiated LOCAL INFILE protocol packet 0xfb without enforcing allowLocalInfile=false. When an application sen...

CVE-2026-50605: Improper Access Control

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. Insufficient access controls within a privileged service may allow an authenticated local user to perform unauthorized registry operations. In certain situations, this could lead to...

Security Bulletin: IBM Sterling Connect:Direct FTP+ is impacted by mulitple vulnerabilities

Summary IBM Java 17 is used by IBM Sterling Connect:Direct FTP+ in product configuration and data transmission. IBM Sterling Connect:Direct FTP+ is impacted by vulnerabilities in IBM Java 17. IBM Sterling Connect:Direct FTP+ has upgraded IBM Java 17 to address the issues CVE-2026-41254,...

CVE-2026-92586

AVideo through 29.0 commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify video access permissions in the setapicomment function, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests to the comment API endpoi...