CVE-2026-105062

The Brandtoss WP Admin Audit plugin for WordPress (versions n/a through 1.2.17 ) is vulnerable to a Missing Authorization vulnerability (CWE-862). This issue allows for exploiting incorrectly configured access control security levels . The impact is categorized as Medium severity with a CVSS3.1 s...

CVE-2026-105062 WordPress WP Admin Audit plugin <= 1.2.17 - Broken Access Control vulnerability

Missing Authorization vulnerability in Brandtoss WP Admin Audit wp-admin-audit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Admin Audit: from n/a through 1.2.17...

CVE-2026-103078

The WordPress JS Help Desk plugin (specifically the js-support-ticket component) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw, identified as CWE-639 . This vulnerability allows for an Authorization Bypass due to incorrectly configured access control security levels, enabling a...

EUVD-2026-92308

Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0...

CVE-2026-103078 WordPress JS Help Desk plugin <= 4.0.0 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0...

CVE-2026-103078 WordPress JS Help Desk plugin <= 4.0.0 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0...

WordPress WP Admin Audit plugin <= 1.2.17 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nixxies in WordPress Plugin WP Admin Audit versions = 1.2.17...

CVE-2026-104386 WordPress WP VR plugin <= 9.1.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through 9.1.3...

EUVD-2026-92304

Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through 9.1.3...

CVE-2026-104386 WordPress WP VR plugin <= 9.1.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through 9.1.3...

CVE-2026-104386

The WP VR (wpvr) plugin for WordPress, versions n/a through 9.1.3 , is affected by a Broken Access Control vulnerability (CWE-862 ). The flaw allows for exploiting incorrectly configured access control security levels due to missing authorization. The impact includes potential changes to confiden...

WordPress WP VR plugin <= 9.1.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Zac Lou in WordPress Plugin WP VR versions = 9.1.3...

EUVD-2026-92290

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Retrieve Embedded Sensitive Data.This issue affects Memberful - Membership Plugin: from n/a through 1.81.2...

CVE-2026-100727

An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local"...

CVE-2026-100727

An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local"...

CVE-2026-100727

An improper access control vulnerability exists in GROWI that allows an unauthenticated attacker to read files located on non-public pages. This vulnerability is specifically triggered when the file upload setting is configured as "Local" . The impact is the unauthorized disclosure of files, and ...

EUVD-2026-92265

An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local"...

CVE-2026-100727

An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local"...

PT-2026-106044

Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org instead of the requested Org. This allows a user with API access in one org to read events from another org for which they have ...

PT-2026-106070

Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lookzy: from n/a through 1.1.14...