PT-2026-90001

Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that unconditionally returns true, so no per-object tree node authorization is...

PT-2026-89777

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belongi...

ROS-20260911-73-0068

The vulnerability of the Password component in Google Chrome and Microsoft Edge is related to lack of access control. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data through a specially created HTML page...

PT-2026-90545

Title Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component Description A lack of authorization control was discovered in the stockAction method in packages/admin/src/Livewire/Components/Products/VariantStock.php. The component exposes a public $variant...

ROS-20260911-73-0037

The vulnerability of Google Chrome and Microsoft Edge web browsers relates to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to cause service interruptions through a specially created HTML page...

ROS-20260911-73-0055

The vulnerability in Chromium is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...

CVE-2026-62114: Missing Authorization

Unauthenticated Broken Access Control in Passster = 4.3.13 versions...

PT-2026-90029

Unauthenticated Broken Access Control in Passster = 4.3.13 versions...

PT-2026-89996

Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization; the Concrete CMS REST API's Express entry collection endpoint disabled the per-entry view permission check. An OAuth token with read scope for an Express entity could enumerate...

PT-2026-90017

Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce = 3.1.0 versions...

ROS-20260911-73-0233

The vulnerability of the Enterprise web browsers Google Chrome and Microsoft Edge is related to lack of access control. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...

CVE-2026-62135: Missing Authorization

Unauthenticated Broken Access Control in Booktics = 1.0.24 versions...

CVE-2026-62136: Missing Authorization

Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce = 2.3.21 versions...

CVE-2026-62132: Missing Authorization

Subscriber Broken Access Control in Masteriyo - LMS = 3.4.0 versions...

CVE-2026-27378: Missing Authorization

Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce = 3.1.0 versions...

CVE-2026-86812: Improper Access Control

The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failure, allowing unauthenticated users to disclose guest order information and to change the status of, or trash...

CVE-2026-47839: Improper Access Control

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: ASSCOPES with ...

BGP OPEN Message Handler DecodeFromBytes() Privilege Escalation

The vulnerability of the DecodeFromBytes function in the pkg/packet/bgp/bgp.go file of the BGP OPEN Message Handler component is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...

BGP Header Handler DecodeFromBytes Privilege Escalation

The vulnerability of the DecodeFromBytes function in the pkg/packet/bgp/bgp.go file of the BGP Header Handler component of the GoBGP border gateway protocol is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...

PT-2026-90507

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to 29.0.3 Description Tokens obtained through delegated authentication methods, including EC2 credentials, application credentials, OAuth1 access tokens, and trusts, are not restricted from creating, modifying...