PT-2026-88876

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authenticated user, such as a subscriber, to read and destroy scan data belonging to the administrator and to overwrite the WPLP Cookie Consent...

CVE-2026-21099: Improper Handling of Insufficient Permissions or Privileges

Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local attackers to access sensitive information...

CVE-2026-71807

The RuoYi-Cloud-Plus software (version

CVE-2026-87876: Improper Handling of Case Sensitivity

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler printer ACL validation and private-attribute filtering could allow bypass of username-based access controls in certain configurations...

CVE-2026-61907

An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user...

PT-2026-89174

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.10.0 through 0.11.0 Description An issue exists in the chat-completions handler within backend/open webui/main.py where the system fails to verify if a user has write access to a specified folder when creating a new chat...

PT-2026-88807

Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

PT-2026-89043

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description Broken access control exists in the AssetModelPolicy where the files method incorrectly cascades from the assets.files permission. This allows authenticated users to upload and delete file attachmen...

PT-2026-89048

Incorrect Permission Assignment for Critical Resource vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus LightDM Greeter allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pardus LightDM Greeter: before 0.4.15...

CVE-2026-71807

In RuoYi-Cloud-Plus = 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive...

PT-2026-88833

Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local attackers to access sensitive information...

PT-2026-88834

Improper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local attackers to launch arbitrary activity...

PT-2026-88856

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a...

CVE-2026-80921: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb crycb 0 or 1, the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and thus in the apcb. This gives a nested...

PT-2026-88765

Tanium addressed an improper access controls vulnerability in Tanium Server...

PT-2026-89033

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description An authenticated user with assets.view permissions can access protected component information because the system fails to enforce the components.view permission on the 'GET...

PT-2026-88783

Tanium addressed an improper access controls vulnerability in Comply...

PT-2026-88843

Improper access control in Watch Plugin prior to Android Watch 17 allows local attackers to access sensitive information...

CVE-2026-13144: Improper Access Control

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking...

PT-2026-88868

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated user, such as a subscriber, to overwrite the cookie banner configuration shown to every visitor and to irreversibly reset the stored A/B te...