PT-2026-78303

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments...

PT-2026-78577

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.3 Description An issue exists where any activated account can access maintenance records for assets within the same company without requiring specific asset or maintenance permissions. This occurs because the sho...

ROS-20260819-73-0017

The vulnerability in MediaWiki is related to the lack of protection for administrative data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

Linux Distros Unpatched Vulnerability : CVE-2026-11817

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization...

PT-2026-78735

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete Splunk Processing Language version 2 SPL2 modules belonging to other users through the data management orchestrator interface. The vulnerability does not affect Splunk...

PT-2026-78643

Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/ in the authorization code OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while...

PT-2026-79951

The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flow...

PT-2026-78274

The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts...

ROS-20260819-73-0065

The vulnerability in Tomcat is related to insufficient technical documentation. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

CVE-2026-18776: Improper Access Control

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow...

CVE-2026-18466: Improper Access Control

The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request...

PT-2026-78575

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.3 Description An issue exists where a company-scoped user in FMCS floater mode can access users with a null company id because the isCurrentUserHasAccess check is not consistently applied during broad API queries...

ROS-20260819-73-0022

The vulnerability in MediaWiki is related to the lack of protection for administrative data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2026-76345: Improper Access Control

In Splunk Enterprise versions below 10.4.2, a user with a high-privilege Splunk role that can manage search head clustering could use the search head cluster member bundle Representational State Transfer REST API to write files to locations that the user account running Splunk Enterprise can writ...

PT-2026-78275

The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users...

PT-2026-78388

phpMyFAQ versions before 4.1.7 fail to validate active status in the PDF export endpoint, allowing unauthenticated attackers to retrieve draft FAQ metadata. Attackers can access the public PDF export route with sequential FAQ identifiers to obtain titles, solution IDs, author names, and last-upda...

PT-2026-78393

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.7 Description Insufficient enforcement of the CONFIGURATION EDIT permission on administrative API read endpoints allows any authenticated user to access sensitive administrative data. By utilizing a valid session...

CVE-2026-13174: Improper Access Control

The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts...

CVE-2026-66589

Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing: from n/a through 5.2.30...

CVE-2026-66589

The B2BKing WordPress plugin (versions through 5.2.30) has a Missing Authorization flaw in its access control, allowing low-privilege users to bypass security levels. CVSS 5.4 MEDIUM reflects low confidentiality and integrity impact. No patch version or exploit details are provided in the documen...