GHSA-99H5-JHH7-V3R3 Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)

Title Missing authorization on Media sub-form store action allows unpermissioned product media update Description A lack of authorization control on the store method was found in packages/admin/src/Livewire/Components/Products/Form/Media.php. The security fix released for GHSA-h4mp-g9c6-xwph adde...

Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

Title Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component Description A lack of authorization control was discovered in the stockAction method in packages/admin/src/Livewire/Components/Products/VariantStock.php. The component exposes a public $variant...

GHSA-G3F9-G5VJ-P62F Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

Title Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component Description A lack of authorization control was discovered in the stockAction method in packages/admin/src/Livewire/Components/Products/VariantStock.php. The component exposes a public $variant...

GHSA-F7H9-QV4X-9X57 Shopping privilege escalation through missing authorization in Settings components

Summary Four Livewire components in the Settings area expose destructive Filament actions delete / edit that perform no server-side authorization. Any authenticated user who can reach the Settings pages — i.e. holding only the coarse accesssetting permission, without being an admin and without an...

Shopping privilege escalation through missing authorization in Settings components

Summary Four Livewire components in the Settings area expose destructive Filament actions delete / edit that perform no server-side authorization. Any authenticated user who can reach the Settings pages — i.e. holding only the coarse accesssetting permission, without being an admin and without an...

CVE-2026-68535

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate method on submitted data, which, for file-referencing blocks such as heroimage and gallery, is where the referenced file is authorized against the user's file-manager...

CVE-2024-11848

CVE-2024-11848 NitroPack = 1.17.0 - Missing Authorization to Authenticated Subscriber+ Limited Options Update Description The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nitropackdismissnoticeforever' AJAX action in a...

CVE-2026-68535

Concrete CMS versions 9.2.0 through 9.5.2 are affected by a missing authorization check in the Area REST API block-create endpoint. The endpoint failed to invoke the block type controller's validate() method, which is responsible for authorizing referenced files against the user's file-manager vi...

CVE-2026-68535 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissions

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate method on submitted data, which, for file-referencing blocks such as heroimage and gallery, is where the referenced file is authorized against the user's file-manager...

CVE-2026-68535 Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissions

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate method on submitted data, which, for file-referencing blocks such as heroimage and gallery, is where the referenced file is authorized against the user's file-manager...

EUVD-2026-76244

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:documenten-api package through version 3.0.0 and the nl.nl-portal:besluiten package from version 1.5.0 through 3.0.0...

CVE-2026-49463 NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:documenten-api package through version 3.0.0 and the nl.nl-portal:besluiten package from version 1.5.0 through 3.0.0...

CVE-2026-49463

NL Portal Backend Libraries (Dutch government portal backend) contained a missing per-user authorization in two GraphQL resolver areas. The nl.nl-portal:documenten-api package (all versions up to 3.0.0) and nl.nl-portal:besluiten package (1.5.0–3.0.0) both declared resolvers without an authentica...

CVE-2026-62089

Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affects Master Addons for Elementor: from n/a through 3.2.2...

WordPress DT LMS – elearning, WordPress LMS Plugin plugin <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification vulnerability

Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification vulnerability discovered by adhikara13 in WordPress Plugin DT LMS – elearning, WordPress LMS Plugin versions = 1.1...

CVE-2026-81909

Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route Process::alias in concrete/controllers/backend/block/process.php.It does not verify that the referenced block is genuinely orphaned on the target page, nor that the caller holds any permission over the...

CVE-2026-81908

Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that unconditionally returns true, so no per-object tree node authorization is...

EUVD-2026-76194

Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affects Master Addons for Elementor: from n/a through 3.2.2...

CVE-2026-62089 WordPress Master Addons for Elementor plugin <= 3.2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affects Master Addons for Elementor: from n/a through 3.2.2...

CVE-2026-62089

CVE-2026-62089 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin Master Addons for Elementor by Pixar Labs, affecting versions from n/a through 3.2.2 . The flaw allows Privilege Abuse , enabling a low-privilege authenticated user to exploit the missing autho...