BIT-TOMCAT-2026-55276 Apache Tomcat: Logged effective web.xml is incomplete

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0 through 11.0.22, from 10.1.0 through 10.1.55, from 9.0.0...

BIT-TOMCAT-2026-43515 Apache Tomcat: Security constraints not correctly applied

Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.21, from 10.1.0 through 10.1.54, from 9.0.0 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 throu...

agency-toolkit-1023-missing-authorization-to-unauthenticated-arbitrary-options-update

NoCVE Agency Toolkit = 1.0.23 - Falta de autorización para la actualización no autenticada de opciones arbitrarias Descripción El complemento Agency Toolkit para WordPress es vulnerable a la modificación no autorizada de datos que puede conducir a una escalada de privilegios debido a la falta de...

js-jobs

js-jobs JS Job Manager 1.1.9 - Instalación/Activación arbitraria de plugins sin autenticación Descripción La acción AJAX jsjobsajax del plugin, disponible tanto para usuarios autenticados como no autenticados, no tiene comprobaciones adecuadas de autorización y CSRF, en particular cuando se...

freemius-exploit

freemius-exploit Freemius Library 2.2.4 - Subscriber+ Arbitrary Option Update Descripción La librería, utilizada en numerosos plugins, no tiene la autorización adecuada al actualizar las opciones del blog, lo que permite a cualquier usuario autenticado, como un suscriptor, actualizar opciones...

CVE-2024-12558

CVE-2024-12558 WP BASE Booking of Appointments, Services and Events history.pushState'', '', '/'; document.forms0.submit;...

CVE-2026-7867-disk2root

Filesystem.Mount → Suplantación de as-user → Omisión de Autorización → Montaje en contexto root → LPE Resumen CVE-2026-7867 es una vulnerabilidad de escalación de privilegios local en udisks2 que involucra el método D-Bus Filesystem.Mount, la opción as-user...

CVE-2024-11423

CVE-2024-11423 Ultimate Gift Cards para WooCommerce = 3.0.6 - Falta de autorización para el glitch de dinero infinito Descripción El plugin Ultimate Gift Cards para WooCommerce – Crea tarjetas de regalo para WooCommerce, vales de regalo, canjea y gestiona cupones digitales de regalo. Ofrece...

santa

Santa !NOTE As of 2025, Santa is no longer maintained by Google. We encourage existing users to migrate to an actively maintained fork of Santa, such as https://github.com/northpolesec/santa. Santa is a binary and file access authorization system for macOS. It consists of a system extension that...

santa

Santa !NOTE 截至2025年，Santa 已不再由 Google 维护。 我们鼓励 现有用户迁移到仍在积极维护的 Santa 分支，例如 https://github.com/northpolesec/santa。 Santa 是 macOS 上一个二进制文件和文件访问授权系统。它由一个监控执行操作的系统扩展、一个基于本地数据库内容做出执行决策的守护进程、一个在阻止决策时通知用户的 GUI 代理，以及一个用于管理系统并与服务器同步数据库的命令行工具组成。 它的名字叫 Santa，因为它会追踪哪些二进制文件是调皮的 naughty 还是乖巧的 nice。 文档 Santa...

CVE-2026-11446

The Booktics – Booking Calendar for Appointments and Service Businesses WordPress plugin (≤ 1.0.23) is vulnerable to unauthorized data modification due to a missing authorization check. The create_order_permission() callback on the POST /wp-json/booktics/v1/orders REST route unconditionally retur...

CVE-2026-11446 Booktics – Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing Authorization

The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the createorderpermission permission callback on the POST /wp-json/booktics/v1/orders REST...

CVE-2026-89151

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...

EUVD-2026-75781

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows...

EUVD-2026-75791

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to improper authorization...

EUVD-2026-75785

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service by deleting arbitrary RabbitMQ queues or exchanges due to improper authorization...

EUVD-2026-75803

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.27 could allow a remote authenticated attacker to bypass security restrictions due to incorrect authorization...

ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation...

PT-2026-90516

A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods are allowed. One such route accepts a request that creates or overwrites a stored record, including an attacker-chosen identifie...

...[ More ]

Apache Impala versions 2.7.0 through 4.5.1 suffer from an insufficient authorization vulnerability that leads to remote code execution. A table created with STORED BY JDBC takes a driver.url property that Impala uses to fetch a remote JAR and load the named driver class on first query, and the...