CVE-2026-97197: Missing Authorization

Unauthenticated Broken Access Control in WordPress Backup & Migration = 1.6.0 versions...

CVE-2026-102146: External Control of File Name or Path

An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations accessible to the Email Protection Gateway service account. This exceeds the administrator's intended privileges and could ...

CVE-2026-100259: Incorrect Authorization

In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access...

CVE-2026-55494: Improper Access Control

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENTSECRET is not configured. The Agent uses request signatures to protect its API routes. However, in agent/auth.py,...

CVE-2026-102397: Missing Authorization

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic = 1.5.5 versions...

CVE-2026-103442: External Control of System or Configuration Setting

External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43...

CVE-2026-55181: Improper Access Control

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDCENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to...

CVE-2026-96818: Missing Authorization

Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...

CVE-2026-96817: Missing Authorization

Subscriber Broken Access Control in MakeCommerce for WooCommerce = 4.1.0 versions...

CVE-2026-95587: Missing Authorization

Unauthenticated Broken Access Control in Hostinger Migrator = 1.0 versions...

CVE-2026-97285: Missing Authorization

Contributor Broken Access Control in The Events Calendar = 6.17.5 versions...

CVE-2026-97267: Missing Authorization

Subscriber Broken Access Control in Prevent files / folders access = 2.6.7 versions...

CVE-2026-96348: Missing Authorization

Unauthenticated Broken Access Control in Bookly = 28.2 versions...

CVE-2026-94120: Missing Authorization

Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms = 2.7.2 versions...

CVE-2026-94074: Missing Authorization

Unauthenticated Broken Access Control in Simply Schedule Appointments = 1.6.12.29 versions...

CVE-2026-89190: Improper Access Control

The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages an...

CVE-2026-75824: Improper Access Control

The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creating an account, allowing unauthenticated users to create accounts on sites where registration is disabled. The created account receives the site's default role...

CVE-2026-86556: Improper Privilege Management

There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control, attackers can exploit the vulnerability to obtain relevant information...

PT-2026-103006

There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control, attackers can exploit the vulnerability to obtain relevant information...

CVE-2026-51867

The software agentgpt v.1.0.0 is vulnerable to Incorrect Access Control within the next/src/server/api/routers/agentRouter.ts component. The issue stems from an externally reachable path that accepts a caller-selected object or tenant identifier, allowing it to perform data-access operations with...