Concrete CMS - User Enumeration

Concrete CMS versions 9.0.0 through 9.5.2 are vulnerable to unauthenticated user enumeration via a missing authorization check in the "Preview As User" panel concrete/controllers/panel/page/previewasuser.php. id: CVE-2026-18110 info: name: Concrete CMS - User Enumeration author: community severit...

dllspy

DllSpy Scans compiled .NET assemblies to discover input surfaces HTTP endpoints, SignalR hubs, WCF services, gRPC services, Razor Pages, Blazor components, Azure Functions, OData endpoints, check authorization configuration, and flag security issues — all without running the application. Availabl...

Powertek Firmware <3.30.30 - Authorization Bypass

Powertek firmware multiple brands before 3.30.30 running Power Distribution Units are vulnerable to authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface /cgi/getparam.cgi with the tmpToken cookie set to an...

PT-2026-134432

Name of the Vulnerable Software and Affected Versions Mapster WP Maps WordPress plugin versions prior to 2.0.6 Description An authorization bypass exists in a REST API route used for writing post data. This allows unauthenticated attackers to overwrite the titles of arbitrary posts, create new...

CVE-2026-13068

An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges...

CVE-2024-6375

A command for refining a collection shard key is missing an authorization check. This may cause the command to run directly on a shard, leading to either degradation of query performance, or to revealing chunk boundaries through timing side channels. This affects MongoDB Server v5.0 versions, pri...

BIT-OPENBAO-2026-115364 OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints

OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When requirerequestheader is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down the...

PT-2026-132456

OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When require request header is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down...

EUVD-2026-111720

The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content of non-public entries, including personal data stored by a companion Royal M...

CVE-2026-115624

The GROWI platform is susceptible to a missing authorization check vulnerability within its collaborative editing feature . This flaw allows users with limited access—such as guest users , users with read-only permissions , or users in pending, suspended, or invited statuses —to bypass intended r...

CVE-2026-115624

GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts...

EUVD-2026-111557

GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts...

CVE-2026-115624

GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts...

PT-2026-127728

GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts...

CVE-2026-115624: GROWI, Inc. GROWI: GROWI contains a missing authorization check vulnerability in its collaborative editing feature

GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts...

CVE-2026-107097: Unknown Royal Addons for Elementor: The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using…

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses...

CVE-2026-102789

Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox 2.20.4.2 - EditorController::getBlogPosts reads the order parameter and invokes getBlogPosts . Unlike other tasks in this controller, it omits the GridboxHelper::checkUserEditLevel check...

EUVD-2026-110644

Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox 2.20.4.2 - EditorController::getBlogPosts reads the order parameter and invokes getBlogPosts . Unlike other tasks in this controller, it omits the GridboxHelper::checkUserEditLevel check...

CVE-2026-102789 Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2

Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox 2.20.4.2 - EditorController::getBlogPosts reads the order parameter and invokes getBlogPosts . Unlike other tasks in this controller, it omits the GridboxHelper::checkUserEditLevel check...

CVE-2026-102789

The Joomla Extension - balbooa.com product, specifically Gridbox versions prior to 2.20.4.2 , is vulnerable to an authorization bypass. The EditorController::getBlogPosts() function fails to perform the required GridboxHelper::checkUserEditLevel() check when reading the order parameter. This impr...