266081 matches found
CVE-2026-97280: Missing Authorization
Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0...
CVE-2026-97277: Missing Authorization
Subscriber Broken Access Control in Social Boost = 3.6.2 versions...
CVE-2026-97258: Missing Authorization
Subscriber Broken Access Control in Aruba Migration Tool = 1.0.4 versions...
CVE-2026-103534: Improper Access Control
A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view of the file /api/v1/snapshots of the component Snapshot Model. This manipulation causes improper access controls. Remote exploitation of the attack is possibl...
CVE-2026-97281: Missing Authorization
Subscriber Broken Access Control in WP Project Manager = 4.0.7 versions...
CVE-2026-66246: Execution with Unnecessary Privileges
iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object references IDOR, enabling privilege escalation and the unauthorized modification or deletion of sensitive application data...
PT-2026-103887
Name of the Vulnerable Software and Affected Versions Aruba Migration Tool versions prior to 1.0.5 Description Broken access control allows subscribers to bypass intended security restrictions. Recommendations Update Aruba Migration Tool to version 1.0.5 or later...
PT-2026-103846
Missing Authorization vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.9...
PT-2026-105798
Impact djust's per-object authorization get object + has object permission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA url change navigation, and c % live render % embedded child views. An...
PT-2026-104049
Name of the Vulnerable Software and Affected Versions infiniflow ragflow version 0.25.3 Description Improper access control exists in the resume function within the 'api/apps/connector app.py' endpoint. This flaw allows an attacker to execute unauthorized cross-session or privilege-crossing...
PT-2026-103845
Authorization Bypass Through User-Controlled Key vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.0...
PT-2026-104015
Name of the Vulnerable Software and Affected Versions Teledyne FLIR Aware2 versions prior to 6.9.0.3 PackBot Teledyne FLIR Aware2 versions prior to 1.7.10 FirstLook Description UDP traffic between the operator control unit and the robot is transmitted in cleartext without a cryptographic integrit...
CVE-2026-63045: Improper Access Control
Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...
PT-2026-104050
Name of the Vulnerable Software and Affected Versions RAGFlow version 0.24.0 Description Improper access control exists in the get dataset function within the 'api/apps/evaluation app' endpoint. This flaw allows an attacker to trigger the execution of arbitrary code or commands controlled by the...
PT-2026-105482
Summary /api/storage/getOutlineStorage is registered with CheckAuth only and performs no authorization of any kind. Given a document identifier it returns that document's stored outline state, regardless of the document's publish tier. The two write endpoints for the same data, setOutlineStorage...
PT-2026-103677
Unpatched vulnerabilities don't stay hidden on our atlas. CVE CRITICAL VULNERABILITY DETECTED CVE ID → CVE-2026-76142 Vendor → Unknown Severity → Critical — CVSS 9.3 Product → Unknown Date → 2026-10-01 A critical vulnerability Improper Access Control has been disclosed affecting Unknown. Patch...
PT-2026-104006
Name of the Vulnerable Software and Affected Versions monta.app affected versions not specified Description The WebSocket Application Programming Interface lacks rate limiting on authentication requests. This deficiency allows an attacker to perform brute-force attacks to obtain unauthorized acce...
PT-2026-103903
Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0...