CVE-2026-17568

Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request. This issue affects : Devolutions Serv...

Malicious code in xo-twofa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47761909a1686ad1db2239f5055c8526e38ac88c07060c886157d157d15b4315 package.json declares a preinstall script that runs node index.js on npm install. index.js collects host identifiers os.hostname, os.platform, os.arc...

CVE-2026-66399 phpMyFAQ before 4.1.6 Privilege Escalation via Group Membership

phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers that allows administrators with only group-management permissions to join privileged groups without verification of required rights. Attackers can add themselves to pre-existing groups holding...

CVE-2026-66477

Unauthenticated Broken Access Control in Gillion = 4.13 versions...

CVE-2026-66442

Subscriber Broken Access Control in YayPricing = 3.5.6 versions...

CVE-2026-65568

Contributor Broken Access Control in Visual Composer Website Builder = 45.15.0 versions...

CVE-2026-65567

Unauthenticated Broken Access Control in Event Tickets = 5.29.0.1 versions...

CVE-2026-65433

Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg = 1.5.1 versions...

CVE-2026-65435

Unauthenticated Broken Access Control in Thrive Leads Version = 10.9.2 versions...

CVE-2026-59560

Subscriber Broken Access Control in FundEngine = 1.7.8 versions...

CVE-2026-59536

Unauthenticated Broken Access Control in CoCart – Headless ecommerce = 4.8.4 versions...

CVE-2026-59530

Unauthenticated Broken Access Control in Stripe For WooCommerce = 4.0.7 versions...

CVE-2026-59534

Unauthenticated Broken Access Control in Post My CF7 Form = 6.2.0 versions...

CVE-2026-65878

Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder 6.7.1- Improper path validation and ACL checks lead to a file deletion vector in the media manager...

EUVD-2026-49252

Unauthenticated Broken Access Control in Gillion = 4.13 versions...

CVE-2026-66477

Unauthenticated Broken Access Control in Gillion = 4.13 versions...

CVE-2026-66477

CVE-2026-66477 affects WordPress Gillion theme versions up to 4.13. The vulnerability is an unauthenticated Broken Access Control in the theme’s access logic, potentially allowing access to restricted resources by unauthenticated users. CVSSv3.1 base score 5.3 (Medium) with AV:N/AC:L/PR:N/UI:N/S:...

CVE-2026-66477 WordPress Gillion theme <= 4.13 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Gillion = 4.13 versions...

CVE-2026-66442 WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability

Subscriber Broken Access Control in YayPricing = 3.5.6 versions...

CVE-2026-66442

CVE-2026-66442 concerns the WordPress plugin YayPricing &lt;= 3.5.6 , reported as Broken Access Control . The CVE record cites a network-based issue with low persistence of impact: confidentiality = none, integrity = low, availability = low; privileges required = low, user interaction = none. No ...