EUVD-2026-64275

The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicatepost function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has editothersposts capability before...

CVE-2026-63042

Apache InLong (versions 2.0.0 through before 2.4.0) contains a missing authorization flaw on its DataNode management endpoints. Any user who can authenticate to the manager can create, modify, and delete Data Node definitions , leading to high impact on integrity and availability (CVSS 8.1, HIGH)...

BIT-KIBANA-2026-72671 Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments

A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomaly detection jobs and data frame analytics jobs. A user whose role grants create anomaly detection jo...

BIT-KIBANA-2026-72655 Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification

Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-915 in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data by an authenticated user who has not been granted case editing privileges, via Manipulating...

CVE-2026-14825

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users...

EUVD-2026-62262

The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, allowing any vendor to modify or permanently delete reviews belonging to other vendors' stores...

CVE-2026-29036

Affected software: cJSON library (versions 1.5.0–1.7.19). Component: decode_pointer_inplace() in cJSON_Utils.c. Issue: Incorrectly-resolved name/reference vulnerability that lets unauthenticated attackers manipulate JSON Patch paths by supplying crafted JSON Pointer escape sequences (~0, ~1). Imp...

UBUNTU-CVE-2026-19550

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...

CVE-2026-19550

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...

CVE-2026-18712

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain...

CVE-2026-18712

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain...

CVE-2026-18712

CVE-2026-18712 describes an issue in MongoDB Server’s Queryable Encryption maintenance operations. An authenticated user who has privileges on one encrypted collection could cause unauthorized modification or destruction of data in a different collection due to insufficient validation of internal...

EUVD-2026-56882

An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should require more specific privileges. This could result in exposure of collection metadata and, on certain deployment configurations,...

CVE-2026-18702 Improper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic Settings

An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring...

CVE-2026-9214

Insufficient input validation vulnerability in the NETGEAR R7000 models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality...

CVE-2026-11737

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to the device software and functionality...

CVE-2026-11738

CVE-2026-11738 describes an insufficient input validation vulnerability affecting certain NETGEAR Nighthawk routers (e.g., RAXE500, RS700, R7000). It allows authenticated administrators on the local network to tamper with router software and functionality, enabling unauthorized modification. The ...

EUVD-2026-56189

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to the device software and functionality...

CVE-2026-11737 Some NETGEAR Nighthawk devices allow administrators to tamper with the device

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to the device software and functionality...

EUVD-2026-56034

A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams via the TicketsController@update endpoint. The endpoint calls no authorize method and performs no team-scoped ownership check. An attacker...