ROS-20261005-73-0149

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261005-73-0148

The vulnerability in the kernel-lt is related to insufficient control of resources during its existence. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261005-73-0147

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

EUVD-2026-92783

Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-update permission can change the password of the built-in super administrator account. The server does not enforce protection for this account, and the update scenario does not...

PT-2026-106230

Name of the Vulnerable Software and Affected Versions dotnet eShop version .NET 8 Description An issue exists in the Ordering API component within the GetOrderAsync function located in the src/Ordering.API/Apis/OrdersApi.cs file. A remote attacker can manipulate the OrderNumber argument to cause...

PT-2026-106035

Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/ accept body- or URL-supplied issue IDs and operate on them without checking that the IDs belong to the caller's workspace and project. The permission...

PT-2026-106071

Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User Manager: from n/a through 2.9.20...

PT-2026-106072

Name of the Vulnerable Software and Affected Versions UsersWP versions prior to 1.2.75 Description Missing authorization allows the exploitation of incorrectly configured access control security levels. Recommendations Update to version 1.2.75 or later...

PT-2026-106029

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0 Description WorkspaceOwnerPermission does not verify if the is active variable is set to True when validating if a user is a workspace owner. This allows a deactivated user to maintain authorization and retain...

PT-2026-106070

Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lookzy: from n/a through 1.1.14...

PT-2026-106170

Name of the Vulnerable Software and Affected Versions Kirillbdev WC Ukraine Shipping versions prior to 1.23.2 Description Kirillbdev WC Ukraine Shipping contains a missing authorization flaw that allows the exploitation of incorrectly configured access control security levels. Recommendations...

PT-2026-106044

Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org instead of the requested Org. This allows a user with API access in one org to read events from another org for which they have ...

PT-2026-106096

Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63...

PT-2026-106224

Name of the Vulnerable Software and Affected Versions Feehi CMS version 2.1.1 Description Incorrect Access Control allows a low-privilege backend administrator with administrator-update permission to change the password of the built-in super administrator account. This occurs because the server...

PT-2026-106092

Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23...

PT-2026-106097

Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2...

PT-2026-106050

Name of the Vulnerable Software and Affected Versions HyperShift operator affected versions not specified Description A flaw in the HyperShift operator allows a tenant isolation bypass. The operator copies user-provided Kubernetes configuration kubeconfig secrets into the privileged control plane...

PT-2026-106095

Name of the Vulnerable Software and Affected Versions Scratch & Win – Giveaways and Contests versions prior to 3.0.2 Description An issue exists where missing authorization allows for the exploitation of incorrectly configured access control security levels. Recommendations Update to a version...

CVE-2026-95263

Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-update permission can change the password of the built-in super administrator account. The server does not enforce protection for this account, and the update scenario does not...

CVE-2026-104397: Missing Authorization

Missing Authorization vulnerability in Jeroen Peters Name Directory name-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Name Directory: from n/a through 1.34.2...