FatPipe WARP/IPVPN/MPVPN - Authorization Bypass

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 contain a missing authorization caused by lack of access control in the web management interface, letting remote attackers access sensitive URLs, exploit requires no authentication. id: CVE-2021-27858 info: name:...

CVE-2025-29705

CVE-2025-29705 CVE-2025-29705 Introduction code-gen: A code generation tool that allows custom templates to generate different code, supporting MySQL, Oracle, SQL Server, PostgreSQL https://gitee.com/durcframework/code-gen This project has no access control, allowing anyone to freely access such...

CVE-2026-81566

Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The add-to-menu routine invoked the commenus item model's save method directly. That model does not perform authorisation itself, because the relevant checks reside in...

CVE-2026-81566

SP Page Builder (Free and Pro, versions 4.0.0 – 6.9.0 ) for Joomla contains a missing access control vulnerability in its add-to-menu routine. The routine invoked the com_menus item model's save() method directly, bypassing the authorization checks that normally reside in the com_menus controller...

CVE-2026-81566 Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0

Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The add-to-menu routine invoked the commenus item model's save method directly. That model does not perform authorisation itself, because the relevant checks reside in...

CVE-2026-81566 Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0

Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The add-to-menu routine invoked the commenus item model's save method directly. That model does not perform authorisation itself, because the relevant checks reside in...

EUVD-2026-77385

Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The add-to-menu routine invoked the commenus item model's save method directly. That model does not perform authorisation itself, because the relevant checks reside in...

CVE-2026-11106-DNS-Zone-Transfer-AXFR-Information-Disclosure

CVE-2026-11106 – DNS ゾーン転送 AXFR 情報漏えい プログラムコード Python DNS サーバー + 攻撃 root@kitploit: dnsserversim.py - Simulated DNS server allowing AXFR from dnslib import DNSRecord, QTYPE, RR, TXT, A import socketserver, socket class DNSHandlersocketserver.BaseRequestHandler: def handleself: data, sock =...

CVE-2026-78084

Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified fi...

CVE-2026-78084

SP Property (a Joomla extension by joomshaper.com) versions below 4.1.4 contain a Missing Access Control vulnerability in the gallery image management controller. The affected controller tasks lacked authorization checks and CSRF token validation , allowing users to invoke file removal actions wi...

CVE-2026-78084 Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4

Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified fi...

EUVD-2026-75392

Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified fi...

CVE-2026-78084 Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4

Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified fi...

JetBrains YouTrack < 2026.2.18769 Information Disclosure (CVE-2026-86496)

The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.18769. It is, therefore, affected by an information disclosure vulnerability: - In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses...

CVE-2026-86496

In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses...

CVE-2026-86496

In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses...

EUVD-2026-72512

In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses...

CVE-2026-86496

JetBrains YouTrack versions before 2026.2.18769 are affected by a missing access control on Helpdesk authorized reporters , which exposed reporter email addresses . The vulnerability requires a low-privilege authenticated network user (no user interaction) and results in a low confidentiality imp...

CVE-2026-85226

CVE-2026-85226 affects the OnDemand correlation engine in MISP , a threat intelligence platform. Correlations were computed solely from matching attribute values without applying distribution, sharing-group, or organization-level access controls , allowing an authenticated low-privileged user to ...

CVE-2026-85226 MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations

MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution, sharing group, organization, or other access-control restrictions associated with the correlated attributes and events...