266105 matches found
PT-2026-103243
Unauthenticated Broken Access Control in Blocksy Companion = 2.1.55 versions...
PT-2026-103230
Unauthenticated Broken Access Control in WordPress Backup & Migration = 1.6.0 versions...
PT-2026-103203
Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...
PT-2026-103186
Unauthenticated Broken Access Control in Hostinger Migrator = 1.0 versions...
PT-2026-103235
Subscriber Broken Access Control in MCP Content Manager Lite = 1.1.0 versions...
CVE-2026-51867: Improper Access Control
agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on tha...
CVE-2026-102141: External Control of File Name or Path
Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster could write files as root onto another node and cause them to be executed there. Exploitation requires backend root access on a cluster node and a...
CVE-2026-97247: Missing Authorization
Unauthenticated Broken Access Control in Blocksy Companion = 2.1.55 versions...
CVE-2026-97243: Missing Authorization
Subscriber Broken Access Control in AllAble Connector = 0.13.4 versions...
CVE-2026-97239: Missing Authorization
Subscriber Broken Access Control in MCP Content Manager Lite = 1.1.0 versions...
CVE-2026-97197: Missing Authorization
Unauthenticated Broken Access Control in WordPress Backup & Migration = 1.6.0 versions...
CVE-2026-102147: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full...
CVE-2026-102146: External Control of File Name or Path
An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations accessible to the Email Protection Gateway service account. This exceeds the administrator's intended privileges and could ...
CVE-2026-100259: Incorrect Authorization
In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access...
CVE-2026-55494: Improper Access Control
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENTSECRET is not configured. The Agent uses request signatures to protect its API routes. However, in agent/auth.py,...
CVE-2026-102397: Missing Authorization
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic = 1.5.5 versions...
CVE-2026-103442: External Control of System or Configuration Setting
External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43...
CVE-2026-55181: Improper Access Control
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDCENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to...
CVE-2026-103105: Incorrect Authorization
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attacker with local access to a node within a Pexip Infinity installation to execute arbitrary code as an unprivileged user on another Pexip Infinity node...