184799 matches found
PT-2026-97297
Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions prior to 12.8.711 ManageEngine Firewall Analyzer versions prior to 12.8.711 Description An issue exists where an authenticated low-privilege user can modify Change Management report schedule configurations for...
PT-2026-97674
This module enables you to add mermaid diagram that displays either inline on an entity or optionally in a modal. The module doesn't sufficiently respect default revision behavior and does not properly limit access to the modal content. This vulnerability is mitigated by the fact that an attacker...
CVE-2026-95604: Missing Authorization
Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...
CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189
This module lets a frontend scanner post CSS-usage measurements to the site so admin reports can show real-page statistics. This module doesn't sufficiently protect the /css-usage-analyzer/save endpoint against forged or repeated submissions...
CVE-2026-94079: Missing Authorization
Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...
CVE-2026-95513: Missing Authorization
Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita = 4.6.0 versions...
PT-2026-97492
Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...
CVE-2026-77765: Improper Access Control
The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing unauthenticated users to pay an arbitrary reduced amount for a fixed-price item...
CVE-2026-91077: Improper Access Control
The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event...
CVE-2026-84789: Authorization Bypass Through User-Controlled Key
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope...
Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188
This module enables you to combine multiple image styles into a single image derivative. The module does not sufficiently validate image style names when generating image derivatives. Under certain circumstances, this allows anonymous users to generate image derivatives without a valid token,...
CVE-2026-66070: Permissive Cross-domain Policy with Untrusted Domains
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...
Gitlab -- vulnerabilities
Gitlab reports: Double Free issue in Regular Expression Parser impacts GitLab CE/EE Integer Overflow issue in Regular Expression Compiler impacts GitLab CE/EE Cross-site Scripting issue in merge request diff viewer impacts GitLab CE/EE Missing Authorization issue in Duo AI job troubleshooting...
CVE-2026-93529: Missing Authorization
Contributor Broken Access Control in WSP MCP – AI Agents Connector = 2.7.0 versions...
CVE-2026-94080: Missing Authorization
Unauthenticated Broken Access Control in MarketKing = 2.1.70 versions...
CVE-2026-94679: Missing Authorization
Subscriber Broken Access Control in Fluent Support = 2.3.2 versions...
CVE-2026-95527: Missing Authorization
Unauthenticated Broken Access Control in Conekta Payment Gateway = 6.2.4 versions...
PT-2026-97454
Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...
PT-2026-97466
Name of the Vulnerable Software and Affected Versions AppMySite versions prior to 3.15.5 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass access restrictions. Recommendations Update to a version newer than 3.15.4...