271 matches found
CVE-2026-85188
Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager Free, Pro 12.1.0, Conditional Content Free, Pro 8.0.0, Content Templater Pro 14.2.0, ReReplacer Pro 16.2.0 for Joomla - The Conditions editor creates a default Condition Set name from the item to which the se...
CVE-2026-85188 Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager (Free, Pro) < 12.1.0, Conditional Content (Free, Pro) < 8.0.0, Content Templater (Pro) < 14.2.0, ReReplacer (Pro) < 16.2.0 for Joomla
Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager Free, Pro 12.1.0, Conditional Content Free, Pro 8.0.0, Content Templater Pro 14.2.0, ReReplacer Pro 16.2.0 for Joomla - The Conditions editor creates a default Condition Set name from the item to which the se...
EUVD-2026-77307
Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager Free, Pro 12.1.0, Conditional Content Free, Pro 8.0.0, Content Templater Pro 14.2.0, ReReplacer Pro 16.2.0 for Joomla - The Conditions editor creates a default Condition Set name from the item to which the se...
CVE-2026-85188
CVE-2026-85188 affects several Regular Labs Joomla extensions : Advanced Module Manager (< 12.1.0), Conditional Content (< 8.0.0), Content Templater (< 14.2.0), and ReReplacer (
EUVD-2026-74950
Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit update on PredefinedKit an...
USN-8676-1 openjdk-17 vulnerabilities
It was discovered that the JSSE component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. CVE-2026-46968 It was discovered that the JSSE component of OpenJDK 17 did not correctly authorize users. A remote attack...
PT-2026-82767
Name of the Vulnerable Software and Affected Versions Ceph versions prior to 20.2.4 Ceph versions prior to 19.2.6 Description The Monitor subscription handler fails to properly authorize access to the configuration-key store. A CephX user with mon allow r capabilities can read the entire store by...
CVE-2026-19350
Dolibarr ERP TakePOS module vulnerability CVE-2026-19350 affects the function fail in htdocs/takepos/invoice.php. The issue enables manipulation that leads to missing authorization, with remote exploitation potential. A patch identified as 8992ce8704da947b6abe7b65a6fe59aed736bb81 is available; ap...
CVE-2026-19350 Dolibarr ERP TakePOS invoice.php fail authorization
A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is...
CVE-2026-16595
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users...
CVE-2026-16595
The WP Directory Kit WordPress plugin is affected (versions before 1.5.5). Affected component: the plugin’s authenticated AJAX action. Root cause: missing authorization/nonce checks, enabling any authenticated user (e.g., a Subscriber) to disclose the site’s user list and unpublished listings bel...
EUVD-2026-53730
A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval Flow. The manipulation results in incorrect authorization. The attack may be performed from remote. The exploit has been made...
EUVD-2026-53705
A vulnerability was detected in zhayujie CowAgent up to 2.1.1. This vulnerability affects the function selecttools of the file agent/evolution/executor.py of the component Self-Evolution Review Agent. Performing a manipulation results in incorrect authorization. The attack is possible to be carri...
CVE-2026-18992
The CVE concerns zhayujie CowAgent, specifically the Self-Evolution Review Agent, where the vulnerability affects the function _select_tools in agent/evolution/executor.py. Affects CowAgent up to version 2.1.1. The root cause is a manipulation that leads to incorrect authorization, enabling a rem...
EUVD-2026-53122
The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the contents of the MLSImport: IDX Plugin & MLS Plugin for Real Esta...
EUVD-2026-52595
The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation, allowing users with Contributor-level access and above to...
EUVD-2026-52249
Sharp and Toshiba Tec MFPs multifunction printers fail to properly authorize requests to directly access certain image data stored to the affected product...
PT-2026-67391
HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular access controls, allowing users to access or view administrator-level functionalities without appropriate authorization...
CVE-2026-16064
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status o...
EUVD-2026-51704
The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the content of arbitrary posts, including other users' private, pending, and draft posts...