PT-2026-103169

Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms = 2.7.2 versions...

PT-2026-103010

Name of the Vulnerable Software and Affected Versions Pexip Infinity versions prior to 38.2 Pexip Infinity version 39.0 Pexip Infinity version 39.1 Pexip Infinity version 40.0 Description Improper access control on a product-internal API allows an attacker with local access to a node within an...

PT-2026-103580

Name of the Vulnerable Software and Affected Versions Kiteworks Core affected versions not specified Description A stored cross-site scripting XSS weakness allows an unauthenticated attacker to store crafted content. This content executes arbitrary JavaScript within the authenticated session of a...

PT-2026-103186

Unauthenticated Broken Access Control in Hostinger Migrator = 1.0 versions...

PT-2026-103202

Subscriber Broken Access Control in MakeCommerce for WooCommerce = 4.1.0 versions...

PT-2026-103239

Subscriber Broken Access Control in AllAble Connector = 0.13.4 versions...

PT-2026-103235

Subscriber Broken Access Control in MCP Content Manager Lite = 1.1.0 versions...

PT-2026-103203

Unauthenticated Broken Access Control in WP Express Checkout Accept PayPal Payments = 2.4.9 versions...

PT-2026-103616

agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on tha...

CVE-2026-97259: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4...

CVE-2026-97285: Missing Authorization

Contributor Broken Access Control in The Events Calendar = 6.17.5 versions...

CVE-2026-103105: Incorrect Authorization

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attacker with local access to a node within a Pexip Infinity installation to execute arbitrary code as an unprivileged user on another Pexip Infinity node...

PT-2026-103243

Unauthenticated Broken Access Control in Blocksy Companion = 2.1.55 versions...

CVE-2026-95587: Missing Authorization

Unauthenticated Broken Access Control in Hostinger Migrator = 1.0 versions...

AlmaLinux 9.2 [TuxCare] Security Update: iscsi-initiator-utils / iscsi-initiator-utils-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787396809)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787396809 advisory. - An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open- iscsi allows remote MITM...

CVE-2026-55181: Improper Access Control

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDCENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to...

PT-2026-103251

Subscriber Broken Access Control in Prevent files / folders access = 2.6.7 versions...

CVE-2026-96817: Missing Authorization

Subscriber Broken Access Control in MakeCommerce for WooCommerce = 4.1.0 versions...

PT-2026-103286

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pause generation, /abort request, /flush cache, and /init weights update group to disrupt inference operations and wedge...

CVE-2026-47492: Missing Authorization

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an attacker can cause improper access control. A successful exploit of this vulnerability might lead to denial of service...