CVE-2026-24609

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Elated-Themes Laurent laurent allows PHP Local File Inclusion.This issue affects Laurent: from n/a through = 3.1...

CVE-2026-24529

Missing Authorization vulnerability in Alejandro Quick Restaurant Reservations quick-restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Restaurant Reservations: from n/a through = 1.6.7...

CVE-2026-24422 phpMyFAQ: Public API endpoints expose emails and invisible questions

phpMyFAQ is an open source FAQ web application. In versions 4.0.16 and below, multiple public API endpoints improperly expose sensitive user information due to insufficient access controls. The OpenQuestionController::list endpoint calls Question::getAll with showAll=true by default, returning...

CVE-2026-24420 phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)

phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below allow an authenticated user without the dlattachment permission to download FAQ attachments due to a incomprehensive permissions check. The presence of a right key is improperly validated as proof of authorization in...

CVE-2026-24366

Missing Authorization vulnerability in YITHEMES YITH WooCommerce Request A Quote yith-woocommerce-request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Request A Quote: from n/a through = 2.46.0...

CVE-2025-70985

Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data outside of their scope...

CVE-2026-24627

CVE-2026-24627: WordPress Trusona plugin evidence shows a Missing Authorization vulnerability in Trusona for WordPress (

CVE-2026-24580 WordPress Ecwid Shopping Cart plugin <= 7.0.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart ecwid-shopping-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ecwid Shopping Cart: from n/a through = 7.0.5...

CVE-2026-24571 WordPress BOX NOW Delivery plugin <= 3.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in boxnow BOX NOW Delivery box-now-delivery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BOX NOW Delivery: from n/a through = 3.0.2...

CVE-2026-24563

Missing Authorization vulnerability in Ashan Perera LifePress lifepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LifePress: from n/a through = 2.1.3...

CVE-2026-24556

CVE-2026-24556 affects WordPress ElementCamp plugin (ElementCamp, element-camp) up to version 2.3.2. The issue is a Missing/Broken Authorization vulnerability in the access-control configuration that may allow unauthorized actions. Public details in connected sources confirm the root cause as inc...

CVE-2026-24532 WordPress SiteLock Security plugin <= 5.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in SiteLock SiteLock Security – WP Hardening, Login Security & Malware Scans sitelock allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteLock Security – WP Hardening, Login Security & Malware Scans: from n/a through =...

Unified Remote Access Control Vulnerability

Unified Remote is a smartphone application that allows a phone to act as a wireless universal remote control. Version 3.9.0.2463 of Unified Remote has a access control vulnerability, which stems from improper handling of specially crafted network packets, potentially leading to remote code...

CVE-2025-70986

Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data...

CVE-2025-70986

Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data...

CVE-2026-24306

Improper access control in Azure Front Door AFD allows an unauthorized attacker to elevate privileges over a network...

CVE-2025-69005

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Elated-Themes Search & Go search-and-go allows PHP Local File Inclusion.This issue affects Search & Go: from n/a through = 2.8...

CVE-2025-69037

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in goalthemes Pippo pippo allows PHP Local File Inclusion.This issue affects Pippo: from n/a through = 1.2.3...

CVE-2026-24366

CVE-2026-24366 : Missing Authorization in the WordPress plugin “YITH Request a Quote for WooCommerce” (YITH WooCommerce Request A Quote) due to incorrectly configured access control. Affected versions: from n/a through 2.46.0. Public sources (NVD, Red Hat, CIRCL, CVE List) describe it as a Broken...

CVE-2026-23975

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in uxper Golo golo allows PHP Local File Inclusion.This issue affects Golo: from n/a through 1.7.5...