CVE-2026-86731 Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController

Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser the users/activate-user action. While the action requires the administrateUsers permission, it does not call requireAdmin when the targeted user is an administrator, unlike the...

CVE-2026-86726 AVideo through 29.0 Information Disclosure via restreamsActive.json.php

AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticated streamers to enumerate source stream keys and identities of all other streamers' active restreams. The endpoint fails to filter results by user ownership, exposing sensitive...

CVE-2026-86725 AVideo SocialMediaPublisher Missing Authorization via add.json.php

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoint that allows authenticated users to modify other users' OAuth token records. Attackers can supply arbitrary row IDs to overwrite another...

EUVD-2026-72861

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoint that allows authenticated users to modify other users' OAuth token records. Attackers can supply arbitrary row IDs to overwrite another...

CVE-2026-86725

AVideo 's SocialMediaPublisher plugin contains a missing authorization flaw in its add.json.php endpoint, affecting versions through commit c3edcc274c389816d434acadac07ee78eaf330c1 . An authenticated attacker can supply arbitrary row IDs to overwrite another user's stored OAuth access_token and r...

CVE-2026-86720

WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) contains a missing authorization flaw in resendRestreamer.json.php , which fails to validate ownership of the live_restreams_id parameter. An authenticated user with canStream permission can supply arbitrary live_restreams_id v...

CVE-2026-86720 WWBN AVideo Missing Authorization via resendRestreamer.json.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of liverestreamsid in resendRestreamer.json.php, allowing authenticated users with canStream to access other users' restream destinations. Attackers can broadcast their live stream to victim-configured...

CVE-2026-12647

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before version 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. The flaw enables privilege escalation beyond the attacker's initial credentials, reflected in a CVSS 3.1 score of 9.9 (Critical) w...

CVE-2026-12647

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

EUVD-2026-72815

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

CVE-2026-12646

Ivanti Neurons for ITSM before version 2026.2 is affected by a Missing Authorization vulnerability that allows a remote authenticated attacker to execute arbitrary code on the server . The CVSS 3.1 base score is 9.9 (CRITICAL) , with a Changed Scope and High impact to confidentiality, integrity, ...

CVE-2026-12646

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

EUVD-2026-72814

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

CVE-2026-12645

CVE-2026-12645 is a Missing Authorization vulnerability in Ivanti Neurons for ITSM affecting versions before 2026.2 . A remote authenticated attacker can leverage this flaw to execute arbitrary code on the server, with the scope changed and high impact on confidentiality, integrity, and availabil...

CVE-2026-12645

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

EUVD-2026-72813

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server...

EUVD-2026-72809

A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. This issue affects the function Update::index of the file controllers/update.php. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be...

CVE-2026-86665

A missing authorization vulnerability in aircheng-org iWebShop-5 (versions up to 5.15 ) affects the Update::index function in controllers/update.php. Unauthenticated remote attackers can manipulate this endpoint, resulting in low impact to confidentiality, integrity, and availability (CVSS 3.1 ba...

CVE-2026-86665 aircheng-org iWebShop-5 update.php index authorization

A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. This issue affects the function Update::index of the file controllers/update.php. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be...

CVE-2026-86665 aircheng-org iWebShop-5 update.php index authorization

A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. This issue affects the function Update::index of the file controllers/update.php. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be...