GHSA-382C-VX95-W3P5 Gittensory: Missing contributor-scoped access control on profile endpoint and MCP tool leaks miner financial data

Summary GET /v1/contributors/:login/profile and the gittensorygetcontributorprofile MCP tool skip the contributor-scoped access check that every sibling endpoint enforces. Any authenticated session/API/MCP token holder can read any contributor's profile; for confirmed Gittensor miners that expose...

WordPress Simply Schedule Appointments plugin <= 1.6.11.11 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by anhcd05 in WordPress Plugin Simply Schedule Appointments versions = 1.6.11.11...

[SECURITY] Fedora 44 Update: opkssh-0.15.0-2.fc44

OpenPubkey SSH is a tool which enables ssh to be used with OpenID Connect allowing SSH access to be managed via identities like aliceaexample.com ins tead of long-lived SSH keys...

CVE-2025-45422

Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass normal restrictions and make arbitrary changes to port forwarding rules...

CVE-2025-45422

The CVE-2025-45422 entry concerns Proximus b-box v8c.725A and describes an Incorrect access control vulnerability. According to the sources, authenticated attackers can bypass normal restrictions and make arbitrary changes to port forwarding rules. The NVD metrics indicate a CVSS 3.1 base score o...

CVE-2025-45422

Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass normal restrictions and make arbitrary changes to port forwarding rules...

FreeBSD : Gitlab -- Vulnerabilities (84ce0c0c-7b4e-11f1-9c40-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 84ce0c0c-7b4e-11f1-9c40-2cf05da270f3 advisory. Gitlab reports: Cross-site Scripting issue in vulnerability evidence table renderer impacts...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the renderin. An attacker can access sensitive information or perform unauthorized actions by exploiting stale render context, which may include helpers, controller, request, viewflow, format/variant details, an...

EUVD-2026-42401

Improper access control in Microsoft Edge Chromium-based allows an unauthorized attacker to bypass a security feature over a network...

Nomad vulnerable to sandbox escape in Docker task driver

Summary HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job submitter to bind-mount a host path into a container even when volume bind mounts are disabled, potentially leading to reading and writing files on the host. This...

EUVD-2026-42374

Gumroad before 2026.07.06.2 contains a broken access control vulnerability in the PurchasesController that allows authenticated sellers to manipulate purchase access for other sellers' products by sending PUT requests to the revokeaccess and undorevokeaccess actions without seller ownership...

CVE-2026-59262

AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit history, allowing authenticated workspace members to retrieve restricted content timelines. Attackers can supply arbitrary document GUIDs to access full edit histories including user names, emails...

WordPress Event Tickets plugin <= 5.28.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by dunvu0 in WordPress Plugin Event Tickets versions = 5.28.5...

CVE-2026-55956

A flaw was found in Apache Tomcat where access control rules for the default servlet are improperly handled. An attacker can exploit this issue to bypass specific HTTP method restrictions, potentially gaining unauthorized access to protected application resources. Mitigation Review your...

CVE-2026-60125

MISP’s importModule path used getEnabledModule to resolve a single import module by name, but this lookup did not enforce the per-organisation module restriction checked by getEnabledModules. As a result, an authenticated user from an organisation that was not allowed to use a module restricted v...

CVE-2026-56246

Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key limitedtoorgs inherits its owner-user's permissions, allowing destructive cross-organization actions. When a user is an admin in two organizations and creates a write-mod...

WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by dunvu0 in WordPress Plugin Razorpay Payment Links for WooCommerce versions = 2.1.4...

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

Improper access control in Microsoft Edge Chromium-based allows an unauthorized attacker to bypass a security feature over a network...

EUVD-2026-42249

Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key limitedtoorgs inherits its owner-user's permissions, allowing destructive cross-organization actions. When a user is an admin in two organizations and creates a write-mod...

WordPress Stock Locations for WooCommerce plugin <= 3.1.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mitchell in WordPress Plugin Stock Locations for WooCommerce versions = 3.1.8...