15104 matches found
PT-2026-81244
Name of the Vulnerable Software and Affected Versions Events 2 affected versions not specified Description The frontend management plugin contains a broken access control issue. The system attributes a newly created event to the submitting user's organizer record only if the request does not...
Wazuh Server 4.9.0 < 4.10.4 / 4.11.0 < 4.14.6 Incorrect Authorization (CVE-2026-41424)
The version of Wazuh Server on the remote host is 4.9.0 prior to 4.10.4, or 4.11.0 prior to 4.14.6. It is, therefore, affected by an incorrect authorization vulnerability: - PUT /security/users/userid passes request.get'user' instead of request.context'tokeninfo''sub' as currentuser. An...
PT-2026-82029
Mattermost doesn't require role-management authorization when setting the scheme admin flag on group syncable link and patch endpoints in github.com/mattermost/mattermost-server...
CVE-2026-66422: Improper Authorization
Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 throu...
JetBrains TeamCity < 2019.2 Multiple Vulnerabilities
The version of JetBrains TeamCity installed on the remote host is prior to 2019.2. It is, therefore, affected by multiple vulnerabilities: - JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role. CVE-2020-7910 - In JetBrains TeamCity before 2019....
PT-2026-82035
Mattermost doesn't restrict role updated websocket event broadcasts to members of the affected team or channel in github.com/mattermost/mattermost-server...
CVE-2026-32561 WordPress Booking Hub plugin <= 1.3.0 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in Booking Hub = 1.3.0 versions...
CVE-2026-32561 WordPress Booking Hub plugin <= 1.3.0 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in Booking Hub = 1.3.0 versions...
CVE-2026-32559
UltimateAI is a WordPress plugin affected by an arbitrary file upload vulnerability in versions ≤ 3.1.0 . A user with Subscriber privilege level can upload arbitrary files without user interaction, with a scope change that allows full compromise of confidentiality, integrity, and availability (CV...
CVE-2026-27364
Broken Access Control vulnerability in the WordPress Style Kits plugin (AnalogWP) versions ≤ 2.6.5 . A Subscriber -level authenticated user can exploit insufficient access controls, resulting in a high impact on integrity (CVSS 3.1: 6.5 MEDIUM, vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). No conf...
EUVD-2026-64955
rConfig 8.0.0 before 8.2.13 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes call in routes/web.php that re-enables the POST /register route after it was explicit...
CVE-2026-39914
TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arbitrary SQL queries to a privileged dashboard Excel export endpoint intended for administrative use only. Attackers can craft and submit unauthorized SQL queries to the export...
CVE-2026-39914
TIM Flow before 26.0.6 contains an improper authorization flaw in a privileged dashboard Excel export endpoint intended for administrative use only. Any authenticated user can submit arbitrary SQL queries to that endpoint, retrieving sensitive database contents as a downloadable spreadsheet and b...
Improper Authorization
Keycloak is vulnerable to Improper Authorization. The vulnerability is due to missing authorization checks in name-based admin REST API endpoints for composite role management, which allows a delegated administrator with manage-realm permissions to remove essential child roles from built-in admin...
CVE-2026-78270
Author SQL Injection in FluentCRM Pro = 3.1.12 versions...
CVE-2026-78272
Subscriber Broken Access Control in Fluent Support Pro = 2.3.1 versions...
CVE-2026-78278
Subscriber Insecure Direct Object References IDOR in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-32478
Subscriber SQL Injection in WP Project Manager Pro = 4.0.1 versions...