190589 matches found
CVE-2026-73385: Missing Authorization
Unauthenticated Broken Access Control in Outranking Plugin Options = 1.1.3 versions...
CVE-2026-50719: Improper Access Control
The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the secure boot state and before invoking signature verification. The init table parser supports full-address 32-bit write operations, allowing...
PT-2026-78296
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers...
PT-2026-78496
Name of the Vulnerable Software and Affected Versions Cisco Secure Workload affected versions not specified Description Improper access control issues exist within the software, categorized under CWE-284, which refers to the improper restriction of operations on a resource. These issues were...
PT-2026-78303
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments...
PT-2026-78577
Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.3 Description An issue exists where any activated account can access maintenance records for assets within the same company without requiring specific asset or maintenance permissions. This occurs because the sho...
PT-2026-78643
Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/ in the authorization code OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while...
PT-2026-79951
The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flow...
PT-2026-78274
The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts...
PT-2026-78575
Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.3 Description An issue exists where a company-scoped user in FMCS floater mode can access users with a null company id because the isCurrentUserHasAccess check is not consistently applied during broad API queries...
ROS-20260819-73-0022
The vulnerability in MediaWiki is related to the lack of protection for administrative data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
PT-2026-78393
Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.7 Description Insufficient enforcement of the CONFIGURATION EDIT permission on administrative API read endpoints allows any authenticated user to access sensitive administrative data. By utilizing a valid session...
PT-2026-78275
The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users...
PT-2026-78388
phpMyFAQ versions before 4.1.7 fail to validate active status in the PDF export endpoint, allowing unauthenticated attackers to retrieve draft FAQ metadata. Attackers can access the public PDF export route with sequential FAQ identifiers to obtain titles, solution IDs, author names, and last-upda...
ROS-20260819-73-0065
The vulnerability in Tomcat is related to insufficient technical documentation. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...
ROS-20260819-73-0017
The vulnerability in MediaWiki is related to the lack of protection for administrative data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
The vulnerability of Microsoft Configuration Manager software for managing IT infrastructure, related to access control errors, allows attackers to escalate their privileges.
The vulnerability of Microsoft Configuration Manager software for managing IT infrastructure is related to access control errors. Exploiting this vulnerability can allow attackers to enhance their privileges...
The vulnerability of software platforms for developing and managing online stores like Magento Open Source, Adobe Commerce, and Adobe Commerce B2B, arises from deficiencies in authentication mechanisms, allowing attackers to escalate their privileges.
The vulnerabilities of the software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B are related to deficiencies in authentication mechanisms. Exploiting these vulnerabilities can allow attackers to enhance their privileges...
Linux Distros Unpatched Vulnerability : CVE-2026-11817
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization...
