PT-2026-90034

Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce = 2.3.21 versions...

PT-2026-90001

Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that unconditionally returns true, so no per-object tree node authorization is...

PT-2026-89777

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belongi...

ROS-20260911-73-0068

The vulnerability of the Password component in Google Chrome and Microsoft Edge is related to lack of access control. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data through a specially created HTML page...

PT-2026-90545

Title Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component Description A lack of authorization control was discovered in the stockAction method in packages/admin/src/Livewire/Components/Products/VariantStock.php. The component exposes a public $variant...

ROS-20260911-73-0037

The vulnerability of Google Chrome and Microsoft Edge web browsers relates to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to cause service interruptions through a specially created HTML page...

ROS-20260911-73-0055

The vulnerability in Chromium is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...

CVE-2026-62114: Missing Authorization

Unauthenticated Broken Access Control in Passster = 4.3.13 versions...

PT-2026-90029

Unauthenticated Broken Access Control in Passster = 4.3.13 versions...

PT-2026-89996

Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization; the Concrete CMS REST API's Express entry collection endpoint disabled the per-entry view permission check. An OAuth token with read scope for an Express entity could enumerate...

PT-2026-90017

Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce = 3.1.0 versions...

ROS-20260911-73-0233

The vulnerability of the Enterprise web browsers Google Chrome and Microsoft Edge is related to lack of access control. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...

CVE-2026-62135: Missing Authorization

Unauthenticated Broken Access Control in Booktics = 1.0.24 versions...

CVE-2026-62136: Missing Authorization

Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce = 2.3.21 versions...

CVE-2026-62132: Missing Authorization

Subscriber Broken Access Control in Masteriyo - LMS = 3.4.0 versions...

CVE-2026-27378: Missing Authorization

Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce = 3.1.0 versions...

CVE-2026-86812: Improper Access Control

The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failure, allowing unauthenticated users to disclose guest order information and to change the status of, or trash...

CVE-2026-47839: Improper Access Control

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: ASSCOPES with ...

FreeBSD : immich -- locked assets remain accessible through shared albums and links (fcc6917b-adbc-11f1-a655-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the fcc6917b-adbc-11f1-a655-3497f65b111b advisory. VulnCheck reports: Immich through 3.1.0 fails to properly enforce locked asset visibility when assets a...

openSUSE 16: tomcat10 / tomcat10-admin-webapps / tomcat10-el-5_0-api / etc (openSUSE-SU-2026:21810-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21810-1 advisory. - CVE-2026-65182: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: TOCTOU when setting specific permissions for Unix Doma...