CVE-2026-82916

Missing Authorization in XmlDsDump in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the webtools base permissions OFBTOOLSVIEW, WEBTOOLSVIEW — explicitly not the ENTITYMAINT permission the export feature declares and visibly refuses to...

CVE-2026-100168

Direct Request 'Forced Browsing' in the Content Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only view-only content permissions OFBTOOLSVIEW and CONTENTMGRVIEW to re-parent content associations they do not own or manage via a direct POST request...

CVE-2026-100168 Apache OFBiz: Missing Authorization vulnerability

Direct Request 'Forced Browsing' in the Content Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only view-only content permissions OFBTOOLSVIEW and CONTENTMGRVIEW to re-parent content associations they do not own or manage via a direct POST request...

CVE-2026-105325 Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations

Missing check for ACCOUNTINGUPDATE / ACCOUNTINGCREATE in accounting in allows user with only ACCOUNTINGVIEW permission to update/create PaymentApplication. Affected versions before : 24.09.08 Users are recommended to upgrade to version 24.09.08 which fixes this issue...

CVE-2026-105325

Missing check for ACCOUNTINGUPDATE / ACCOUNTINGCREATE in accounting in allows user with only ACCOUNTINGVIEW permission to update/create PaymentApplication. Affected versions before : 24.09.08 Users are recommended to upgrade to version 24.09.08 which fixes this issue...

CVE-2026-105461

Apache OFBiz versions prior to 24.09.08 are vulnerable to a missing authorization check in the ordermgr component. Specifically, the updateOrderItems function fails to verify the ORDERMGR_UPDATE permission, allowing users with only ORDERMGR_VIEW permissions to modify order prices and quantities. ...

CVE-2026-109856

Apache OFBiz versions 24.09 before 24.09.08 are vulnerable to a missing authorization flaw in Financial Account services . An authenticated user with a low-privilege account can perform Forced Browsing to access several services, including createFinAccount, updateFinAccount, deleteFinAccount, cre...

EUVD-2026-117340

The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks in one of its AJAX actions, allowing unauthenticated users to retrieve details of event submissions awaiting moderation, which are not available anywhere on the public site...

CVE-2026-122320

Kyverno before 1.19.2 contains a missing authorization vulnerability that allows namespaced Policy authors to read resources in other namespaces by templating generate.clone or cloneList namespace values. Attackers can annotate a triggering ConfigMap so the background-controller copies a victim...

CVE-2026-122316

Kyverno from 1.17.0 before 1.19.2 contains a missing authorization vulnerability in the mutate-existing background processor that allows namespaced tenants to modify resources outside their namespace. Attackers can create a NamespacedMutatingPolicy targeting Namespace objects or victim-namespace...

CVE-2026-122320

Kyverno versions before 1.19.2 are vulnerable to a missing authorization vulnerability (CWE-862) allowing namespaced Policy authors to perform cross-namespace resource reads. By templating generate.clone or cloneList namespace values, an attacker can annotate a triggering ConfigMap. This causes t...

EUVD-2026-117230

Kyverno before 1.19.2 contains a missing authorization vulnerability that allows namespaced Policy authors to read resources in other namespaces by templating generate.clone or cloneList namespace values. Attackers can annotate a triggering ConfigMap so the background-controller copies a victim...

EUVD-2026-117227

Kyverno from 1.17.0 before 1.19.2 contains a missing authorization vulnerability in the mutate-existing background processor that allows namespaced tenants to modify resources outside their namespace. Attackers can create a NamespacedMutatingPolicy targeting Namespace objects or victim-namespace...

CVE-2026-122316

Kyverno versions 1.17.0 before 1.19.2 are affected by a missing authorization vulnerability in the mutate-existing background processor. This flaw allows namespaced tenants to modify resources outside their own namespace. By creating a NamespacedMutatingPolicy that targets Namespace objects or re...

Concrete CMS - User Enumeration

Concrete CMS versions 9.0.0 through 9.5.2 are vulnerable to unauthenticated user enumeration via a missing authorization check in the "Preview As User" panel concrete/controllers/panel/page/previewasuser.php. id: CVE-2026-18110 info: name: Concrete CMS - User Enumeration author: community severit...

PublishPress Capabilities < 2.3.1 - Missing Authorization

The PublishPress Capabilities plugin for WordPress before 2.3.1 does not have proper authorization and CSRF checks when updating settings via the init hook, allowing unauthenticated attackers to update arbitrary blog options, such as setting the default role to administrator. id: CVE-2021-25032...

WCFM Membership <= 2.10.0 - Broken Access Control

The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks true the AJAX actions: wcfm-memberships, wcfm-memberships-manage, and wcfm-memberships-settings. id: CVE-2022-4940 info:...

Arcane < 1.18.0 - Unauthenticated Template and Env Disclosure

Arcane 1.18.0 contains an information disclosure caused by missing authorization on /api/templates GET endpoints, letting unauthenticated network clients read sensitive Compose YAML and .env content, exploit requires network access id: CVE-2026-42461 info: name: Arcane 1.18.0 - Unauthenticated...

LottieFiles WordPress Plugin <= 3.0.0 - Missing Authorization

LottieFiles LottieFiles = 3.0.0 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers exploit missing authorization, exploit requires no special privileges. id: CVE-2025-68043 info: name: LottieFiles WordPress Plugin =...

WPZOOM Social Icons Widget <= 4.2.15 - Missing Authorization

WPZOOM Social Icons Widget & Block versions up to 4.2.15 contain a missing authorization vulnerability caused by insufficient access control in the widget and block, letting attackers perform unauthorized actions, exploit requires no special conditions. id: CVE-2024-30464 info: name: WPZOOM Socia...