CVE-2026-66473 WordPress Xendit Payment plugin <= 7.1.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Xendit Payment = 7.1.0 versions...

CVE-2026-66473

Unauthenticated Broken Access Control in Xendit Payment = 7.1.0 versions...

CVE-2026-66473

The vulnerability CVE-2026-66473 affects the WordPress Xendit Payment plugin, versions up to and including 7.1.0. It is described as Unauthenticated Broken Access Control, indicating that unauthenticated users may access restricted functionality or data within the plugin. The available sources id...

CVE-2026-12383

A flaw was found in the Event-Driven Ansible EDA server. The ExternalEventStreamViewSet uses permissive access controls permissionclasses=AllowAny, authenticationclasses= and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a...

CVE-2026-17568

Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request. This issue affects : Devolutions Serv...

CVE-2026-17569

CVE-2026-17569: Improper access control in the NetBox synchronizer of Devolutions Server allows an authenticated user with view-only access on an entry to retrieve a stored API token via the partial connection endpoint. Affected products/versions include Devolutions Server 2026.2.4.0 through 2026...

EUVD-2026-49379

Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server...

CVE-2026-17568

Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request. This issue affects : Devolutions Serv...

CVE-2026-66399 phpMyFAQ before 4.1.6 Privilege Escalation via Group Membership

phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers that allows administrators with only group-management permissions to join privileged groups without verification of required rights. Attackers can add themselves to pre-existing groups holding...

CVE-2026-66477

Unauthenticated Broken Access Control in Gillion = 4.13 versions...

CVE-2026-66442

Subscriber Broken Access Control in YayPricing = 3.5.6 versions...

CVE-2026-65568

Contributor Broken Access Control in Visual Composer Website Builder = 45.15.0 versions...

CVE-2026-65567

Unauthenticated Broken Access Control in Event Tickets = 5.29.0.1 versions...

CVE-2026-65433

Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg = 1.5.1 versions...

CVE-2026-65435

Unauthenticated Broken Access Control in Thrive Leads Version = 10.9.2 versions...

CVE-2026-59560

Subscriber Broken Access Control in FundEngine = 1.7.8 versions...

CVE-2026-59536

Unauthenticated Broken Access Control in CoCart – Headless ecommerce = 4.8.4 versions...

CVE-2026-59530

Unauthenticated Broken Access Control in Stripe For WooCommerce = 4.0.7 versions...

CVE-2026-59534

Unauthenticated Broken Access Control in Post My CF7 Form = 6.2.0 versions...

CVE-2026-65878

Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder 6.7.1- Improper path validation and ACL checks lead to a file deletion vector in the media manager...