CVE-2026-77026

Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions...

CVE-2026-77026 Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5

Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions...

CVE-2026-77026

Convert Forms (by tassos.gr) for Joomla , versions below 5.2.5 , is affected by a client-controlled validation bypass. The front-end Submissions view did not enforce access control, allowing an unauthenticated visitor to list a form's submissions. The CVSS 4.0 base score is 6.9 (MEDIUM) , with a ...

EUVD-2026-63242

Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions...

CVE-2026-77026 Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5

Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions...

CVE-2026-14949 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Incorrect Authorization due to improper enforcement of role-based access control

A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new accounts with arbitrary role values, including the highest privilege level used by the application...

WordPress Wired Impact Volunteer Management plugin < 2.8.2 - Subscriber+ Arbitrary RSVP Removal via wivm_remove_rsvp vulnerability

Subscriber+ Arbitrary RSVP Removal via wivmremoversvp vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Wired Impact Volunteer Management versions 2.8.2...

WordPress EPROLO Dropshipping plugin <= 2.4.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by hivesec in WordPress Plugin EPROLO Dropshipping versions = 2.4.2...

CVE-2026-76334

creationtimestamp| type| source ---|---|--- 2026-08-20 04:46:32+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-76321

creationtimestamp| type| source ---|---|--- 2026-08-20 04:46:02+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

CVE-2026-2092 vulnerabilities

Vulnerabilities for packages: keycloak...

EUVD-2026-62961

In Splunk AI Toolkit versions below 6.0.0, a user that holds a role with the schedulesearch capability could cause a scheduled search to load and deserialize a model file through the apply search command. The improper access control is possible because Splunk AI Toolkit does not mark the apply...

EUVD-2026-62916

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use crafted report notification data to cause Splunk Secure Gateway to send a request to...

EUVD-2026-63108

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read sensitive Security Assertion Markup Language setup and instance settings information...

EUVD-2025-210743

IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to read or modify another user's command history due to an externally controlled filename...

PT-2026-79191

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 3.0.29 Description Presenters can submit a presentationId through the '/api/graphql' endpoint that identifies a presentation belonging to a different meeting. The RemovePresentationPubMsgHdlr.scala function fail...

PT-2026-80755

Name of the Vulnerable Software and Affected Versions Winter CMS versions prior to 1.2.13 Description The backend FileUpload form widget improperly trusts the file id POST parameter when resolving attachments. The getFileRecord function resolves the provided ID against the global system files tab...

PT-2026-79196

Name of the Vulnerable Software and Affected Versions TREK versions prior to 3.1.3 Description An authenticated user with file-edit permissions can disclose the existence and titles of reservations across private trip boundaries. The application fails to use the findForeignLinkTarget function to...

The vulnerability of the ALTER TABLE ALTER TYPE command in the PostgreSQL database management system allows a hacker to gain unauthorized access to delete or modify data.

The vulnerability of the ALTER TABLE/ALTER TYPE command in the PostgreSQL database management system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to delete or modify data...

PT-2026-78944

Name of the Vulnerable Software and Affected Versions Altair versions prior to 5.2.3 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a version newer than 5.2.2...