169044 matches found
PT-2026-86348
🚨 CVE-2026-84745 The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site,...
PT-2026-86336
🚨 CVE-2026-81348 The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory...
PT-2026-86447
Name of the Vulnerable Software and Affected Versions N-central versions prior to 2026.3 HF3 N-central versions prior to 2026.4 Description An issue in the internal API access control filter allows unauthorized access to internal APIs. Recommendations Update to version 2026.3 HF3. Update to versi...
CVE-2026-52766 YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the erasespamedcomments wiki action actions/EraseSpamedCommentsAction.php accepts a suppr array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the...
CVE-2026-86091
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traff...
AZL-99693 CVE-2026-86091 affecting package ntopng 5.2.1-6
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traff...
CVE-2026-86091 ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traff...
CVE-2026-86091 ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler
ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traff...
EUVD-2026-57455
SiYuan: Embedded transclusion block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers...
EUVD-2026-57456
SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers...
EUVD-2026-57459
SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers...
CVE-2026-53769
Avo , a Ruby on Rails admin panel framework, contains a missing server-side authorization vulnerability in Avo::AttachmentsController#create (the direct attachment upload endpoint) affecting versions 2.28.0 through before 3.32.0 . The endpoint creates an ActiveStorage::Blob before validating the ...
CVE-2026-80112
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an improper access control vulnerability in the DirectIo64.sys kernel driver that allows unprivileged local users to perform privileged hardware operations by opening...
CVE-2026-85781 Unverified access point ownership in Amazon EFS CSI Driver
Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized...
CVE-2026-80112 PassMark PerformanceTest, BurnInTest, and OSForensics Improper Access Control via DirectIo64.sys
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an improper access control vulnerability in the DirectIo64.sys kernel driver that allows unprivileged local users to perform privileged hardware operations by opening...
EUVD-2026-71683
PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an improper access control vulnerability in the DirectIo64.sys kernel driver that allows unprivileged local users to perform privileged hardware operations by opening...
CVE-2026-80112
PassMark PerformanceTest , BurnInTest , and OSForensics each ship a vulnerable DirectIo64.sys kernel driver. The root cause is an improper access control flaw: the device object is created without a security descriptor, so Windows applies a permissive default ACL . This allows unprivileged local ...
MGASA-2026-0376 Updated tomcat packages fix security vulnerabilities
Incorrect URL decoding in RewriteValve may allow security control bypass. CVE-2026-59083 EncryptInterceptor requirements not clearly documented. CVE-2026-59084 DoS via WebSocket chat example. CVE-2026-66299 Bypass longest prefix security constraint. CVE-2026-65182 TOCTOU when setting specific...
CVE-2026-61688
SolidInvoice , an open-source invoicing platform, is affected by a cross-user information disclosure vulnerability prior to version 3.0.1 . An authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveCom...