CVE-2026-104033

A flaw was found in SSSD. When configured to enforce account expiration using LDAP Lightweight Directory Access Protocol shadow attributes, SSSD fails to treat an expiration value of zero as an expired account. A user with valid credentials for an expired account can exploit this flaw to bypass...

CVE-2026-39794: Missing Authorization

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API = 1.6.3 versions...

Security Advisory 0190

Security Advisory 0190 . CSAF PDF Date: October 6, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 6, 2026 | Initial release Description All of the CVEs covered in this advisory affect only CloudVision-CUE on-premises. CV-CUE is Arista’s Wi-Fi management service and, in on-premises...

ROS-20261006-73-0165

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-32576: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in ZWEISCHNEIDER Faktur Pro for WooCommerce woorechnung allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Faktur Pro for WooCommerce: from n/a through 3.2.2...

CVE-2026-95526: Missing Authorization

Unauthenticated Broken Access Control in BEAR = 1.2.2 versions...

Brocade Fabric OS authentication and access control bypass via HTTP host header spoofing

: An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the client-supplied HTTP host header instead of the actual...

Privilege Escalation / Access Control Bypass in Brocade Fabric OS Web Management Framework (CVE-2026-94575)

: A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control RBAC checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for...

A race condition vulnerability exists in the web management daemon on Brocade Fabric OS versions before 10.0.1 (CVE-2026-94584)

: A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handling user authentication requests across a multi-threaded execution pool, this race condition causes PAM modules to process stale or incorrect client IP...

PT-2026-106732

Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert Mail allows Brute Force. This issue affects Expert Mail: through 2026-09-18...

ROS-20261006-73-0189

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261006-73-0004

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-106417

Name of the Vulnerable Software and Affected Versions Wise Chat versions prior to 3.4.3 Description An authorization flaw exists due to incorrectly configured access control security levels, which allows for broken access control for subscribers. Recommendations Update to version 3.4.3 or later...

PT-2026-106435

Name of the Vulnerable Software and Affected Versions Autoship Cloud for WooCommerce Subscription Products versions prior to 2.17.2 Description An issue exists in the autoship-cloud plugin where missing authorization allows the exploitation of incorrectly configured access control security levels...

PT-2026-106385

Subscriber Broken Access Control in Delete All Comments of wordpress = 7.1 versions...

PT-2026-106808

Name of the Vulnerable Software and Affected Versions @payloadcms/db-mongodb versions prior to 3.87.0 @payloadcms/db-mongodb canary versions prior to 4.0.0-canary.20 Description An authenticated user with permissions to update a document can modify fields that should be restricted by field-level...

PT-2026-107145

Name of the Vulnerable Software and Affected Versions Arista CloudVision CUE versions prior to 2026.2.1 Description An access-control flaw in the CV-CUE backend allows an unauthenticated network attacker to access functionality intended only for internal services. This may lead to the exposure of...

PT-2026-106792

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.90.0 Payload canary versions prior to 4.0.0-canary.34 Description An attacker can submit a request to a specific update endpoint to modify collection documents. This occurs when orderable is enabled on a collection ...

PT-2026-107196

Name of the Vulnerable Software and Affected Versions HPE Networking ClearPass Policy Manager Android client application affected versions not specified Description An improper access control issue allows application functionality to be invoked by untrusted sources. This could enable an...

PT-2026-106783

Name of the Vulnerable Software and Affected Versions Payload versions 3.0.0 through 3.89.9 Payload versions prior to 4.0.0-canary.34 Description An access-control bypass exists in the duplicate operation, which allows the copying of values from a source document even if a field is hidden or if t...