EUVD-2026-67137

An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could allow an attacker to gain access to some user accounts...

CVE-2026-80203 Grav before 1.0.18 Authentication Bypass via Scoped API Key

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin on the acting account rather than verifying whether the specific API key carri...

EUVD-2026-66166

GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 suffers from a Broken access control vulnerability in the IP lock manager, which allows remote authenticated users to add, modify, or delete IP lock entries for arbitrary accounts via tools.php?action=iplock...

CVE-2026-19851 Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5

A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access to user accounts created during XML import...

CVE-2026-19851 Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5

A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access to user accounts created during XML import...

CVE-2026-56710 Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock

Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the...

PT-2026-81873

Name of the Vulnerable Software and Affected Versions GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 Description Broken access control in the IP lock manager allows remote authenticated users to add, modify, or delete IP lock entries for arbitrary accounts. This is...

CVE-2026-38474

GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 suffers from a Broken access control vulnerability in the IP lock manager, which allows remote authenticated users to add, modify, or delete IP lock entries for arbitrary accounts via tools.php?action=iplock...

Missing Authorization

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authorization through the register API endpoint. An attacker can create unauthorized user accounts by sending crafted requests to the affected A...

EUVD-2026-62564

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.9.0 until 4.10.4 and 4.14.6, PUT /security/users/userid in api/api/controllers/securitycontroller.py passes request.get"user" instead of request.context'tokeninfo''sub' as currentuser...

CVE-2026-13174: Improper Access Control

The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts...

PT-2026-78503

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.9.0 until 4.10.4 and 4.14.6, PUT /security/users/user id in api/api/controllers/security controller.py passes request.get"user" instead of request.context'token info''sub' as current user. remove...

CVE-2026-49223

Vvveb CMS (versions before 1.0.8.4) has an authorization bypass in admin/sql/sqlite/product_review.sql, which accepts a caller-controlled product_review_id without verifying ownership against the current admin's admin_id. A low-privileged Vendor can read, edit, approve, or delete reviews under an...

EUVD-2026-60549

Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability LTI under certain circumstances. This applies to LTI 1.1 and LTI 1.3 Advantage...

CVE-2026-75843: Improper Privilege Management

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting authorization checks. Attackers can execute executeCommand with a transaction ID to run...

CVE-2026-42163

Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability LTI under certain circumstances. This applies to LTI 1.1 and LTI 1.3 Advantage...

CVE-2026-42163

Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability LTI under certain circumstances. This applies to LTI 1.1 and LTI 1.3 Advantage...

CVE-2026-42163

Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability LTI under certain circumstances. This applies to LTI 1.1 and LTI 1.3 Advantage...

CVE-2026-42163

Versions of Mahara prior to 25.04.5 and 26.04.0 are vulnerable to unauthorized access to internal accounts. This security flaw occurs under certain circumstances when using Learning Tools Interoperability (LTI) , specifically affecting both LTI 1.1 and LTI 1.3 Advantage . While the vulnerability ...

PT-2026-76868

Name of the Vulnerable Software and Affected Versions Mahara versions prior to 25.04.5 Mahara versions prior to 26.04.0 Description Unauthorized access to internal accounts is possible via Learning Tools Interoperability LTI, which is a standard for connecting learning applications. This issue...