CVE-2026-66588: Undefined Security Weakness

Unauthenticated Broken Access Control in The7 = 14.2.2 versions...

CVE-2026-39762: Missing Authorization

Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.17.1...

ROS-20261006-73-0231

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261006-73-0168

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261006-73-0179

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261006-73-0199

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261006-73-0070

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-106486

Subscriber Broken Access Control in Progress Planner = 1.10.0 versions...

ROS-20261006-73-0449

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261006-73-0443

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261006-73-0458

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261006-73-0284

The vulnerability in the kernel-lt is related to access control deficiencies. Exploiting this vulnerability can allow an attacker to enhance their privileges...

PT-2026-106783

Name of the Vulnerable Software and Affected Versions Payload versions 3.0.0 through 3.89.9 Payload versions prior to 4.0.0-canary.34 Description An access-control bypass exists in the duplicate operation, which allows the copying of values from a source document even if a field is hidden or if t...

PT-2026-106792

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.90.0 Payload canary versions prior to 4.0.0-canary.34 Description An attacker can submit a request to a specific update endpoint to modify collection documents. This occurs when orderable is enabled on a collection ...

PT-2026-106808

Name of the Vulnerable Software and Affected Versions @payloadcms/db-mongodb versions prior to 3.87.0 @payloadcms/db-mongodb canary versions prior to 4.0.0-canary.20 Description An authenticated user with permissions to update a document can modify fields that should be restricted by field-level...

PT-2026-106800

Name of the Vulnerable Software and Affected Versions @payloadcms/storage-s3 versions prior to 3.90.0 @payloadcms/storage-s3 canary versions prior to 4.0.0-canary.34 Description An authenticated user can overwrite an existing S3 object belonging to another upload collection. This occurs when clie...

ROS-20261006-73-0153

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261006-73-0117

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-106708

Name of the Vulnerable Software and Affected Versions Craft CMS version 5.10.13.2 Description An authenticated remote code execution issue exists in the Control Panel action 'app/render-components'. Users with basic Control Panel access can submit request-controlled component classes and property...

CVE-2026-106503: Improper Handling of Case Sensitivity

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected Scaffolder templates could bypass...