PT-2026-89592

IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This could result in information disclosure or denial of service...

PT-2026-89370

Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device Wi-Fi configuration information through these interfaces...

CVE-2026-81786: Missing Authorization

Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce = 1.2.2 versions...

PT-2026-89439

Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions...

PT-2026-89293

The zipMoneyZip Co Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options...

PT-2026-89306

🚨 CRITICAL: CVE-2026-8323 CVSS 9.3 - Open Redirect flaw in Armiya Access Control System pre-v2. Network exploitable, no privileges required. Patch to Version 2+ immediately. CVE PatchNow ThreatIntel https://t.co/HFYrIplBhl...

CVE-2026-79725: Improper Access Control

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control...

CVE-2026-81794: Missing Authorization

Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions...

CVE-2026-78536: Missing Authorization

Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce = 1.8.9 versions...

CVE-2026-76653: Buffer Over-read

A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 v2, v3 & v5 and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials...

CVE-2026-81793: Missing Authorization

Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a through 10.31.9...

CVE-2026-81788: Missing Authorization

Subscriber Broken Access Control in IMPress for IDX Broker = 3.3.0 versions...

CVE-2026-7188: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows SQL Injection. This issue affects Access Control System: before Versiyon 2...

PT-2026-89432

Unauthenticated Broken Access Control in BuddyForms = 2.9.0 versions...

CVE-2026-81799: Missing Authorization

Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce = 4.6.4 versions...

PT-2026-89371

Name of the Vulnerable Software and Affected Versions Capgo affected versions not specified Description Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, which leaves stale overrides active. This allows attackers to retain channel-specif...

CVE-2026-8323: URL Redirection to Untrusted Site

URL redirection to untrusted site 'open redirect' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows Fake the Source of Data. This issue affects Access Control System: before Versiyon 2...

PT-2026-89427

Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce = 1.8.9 versions...

ROS-20260910-73-0088

The vulnerability of the Dawn component in Google Chrome and Microsoft Edge is related to lack of access control. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data through a specially created HTML page...

PT-2026-89736

Name of the Vulnerable Software and Affected Versions @jhb.software/payload-alt-text-plugin version 0.7.0 Description An authorization bypass exists in the @jhb.software/payload-alt-text-plugin plugin for Payload CMS. The plugin exposes the endpoints POST /api/alt-text-plugin/generate and POST...