EUVD-2026-64679

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

CVE-2026-78203

Ghostwriter before 7.1.2 contains a cross-client authorization flaw in the report template swap endpoint . The endpoint fails to validate template ownership, and because template primary keys are sequential, an authenticated attacker can enumerate and attach templates belonging to other clients t...

EUVD-2026-64678

Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then...

The vulnerability of the IndexedDB component in web browsers such as Firefox, Firefox ESR, and the email client Thunderbird allows a hacker to induce a service failure.

The vulnerability of IndexedDB in web browsers such as Firefox, Firefox ESR, and the email client Thunderbird is related to deficiencies in access control in isolated environments. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the WebRender component in Firefox web browsers, Firefox ESR, and the Thunderbird email client allows a hacker to trigger a service failure.

The vulnerability of the WebRender component in Firefox web browsers, Firefox ESR, and the email client Thunderbird is related to deficiencies in access control in isolated environments. Exploiting this vulnerability could allow a malicious actor to cause service failures...

PT-2026-80825

Name of the Vulnerable Software and Affected Versions Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More versions prior to 1.7.2 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions...

The vulnerability of the Telemetry component in Firefox web browsers, Firefox ESR, and the Thunderbird email client allows a hacker to trigger a service failure.

The vulnerability of the Telemetry component in Firefox web browsers, Firefox ESR, and the Thunderbird email client is related to deficiencies in access control in isolated environments. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the WebRender component in Firefox web browsers, Firefox ESR, and the Thunderbird email client allows a hacker to trigger a service failure.

The vulnerability of the WebRender component in Firefox web browsers, Firefox ESR, and the email client Thunderbird is related to deficiencies in access control in isolated environments. Exploiting this vulnerability could allow a malicious actor to cause service failures...

PT-2026-81045

Name of the Vulnerable Software and Affected Versions Style Kits versions prior to 2.6.6 Description Broken Access Control allows a user with Subscriber privileges to perform unauthorized actions. Recommendations Update Style Kits to version 2.6.6 or later...

Cisco Catalyst SD-WAN Manager Information Disclosure (cisco-sa-sdwan-infodis-SPuJBDCe)

According to its self-reported version, Cisco SD-WAN Viptela Software is affected by a vulnerability. - An information disclosure vulnerability exists in the web-based management interface of Cisco Catalyst SD-WAN Manager due to insufficient access control enforcement for specific template types...

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and...

ROS-20260824-73-0002

The vulnerability in the incus is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...

ROS-20260824-73-0001

The vulnerability in the incus is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...

PT-2026-80904

BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a...

The vulnerability in web browsers Firefox, Firefox ESR, and the email client Thunderbird relates to deficiencies in access control in isolated environments, allowing attackers to trigger a service failure.

The vulnerabilities of the Firefox web browser, Firefox ESR, and the Thunderbird email client are related to deficiencies in access control within isolated environments. Exploiting these vulnerabilities can allow a malicious actor to cause service failures...

CVE-2026-77116

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

EUVD-2026-64639

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

CVE-2026-77116

Brave Popup Builder (WordPress plugin, slug: brave-popup-builder) versions through 0.8.5 contain a broken access control vulnerability. Any authenticated user with a low-privilege role (Subscriber or WooCommerce Customer) can read unpublished popup content by passing a post ID in the URL, effecti...

CVE-2026-77116 Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup Disclosure via Preview

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

EUVD-2026-64636

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...