169486 matches found
CVE-2026-66473
Unauthenticated Broken Access Control in Xendit Payment = 7.1.0 versions...
CVE-2026-12383
A flaw was found in the Event-Driven Ansible EDA server. The ExternalEventStreamViewSet uses permissive access controls permissionclasses=AllowAny, authenticationclasses= and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a...
CVE-2026-17568
Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request. This issue affects : Devolutions Serv...
CVE-2026-17569
CVE-2026-17569: Improper access control in the NetBox synchronizer of Devolutions Server allows an authenticated user with view-only access on an entry to retrieve a stored API token via the partial connection endpoint. Affected products/versions include Devolutions Server 2026.2.4.0 through 2026...
EUVD-2026-49379
Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server...
CVE-2026-17568
Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request. This issue affects : Devolutions Serv...
CVE-2026-66399 phpMyFAQ before 4.1.6 Privilege Escalation via Group Membership
phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers that allows administrators with only group-management permissions to join privileged groups without verification of required rights. Attackers can add themselves to pre-existing groups holding...
CVE-2026-66477
Unauthenticated Broken Access Control in Gillion = 4.13 versions...
CVE-2026-66442
Subscriber Broken Access Control in YayPricing = 3.5.6 versions...
CVE-2026-65568
Contributor Broken Access Control in Visual Composer Website Builder = 45.15.0 versions...
CVE-2026-65567
Unauthenticated Broken Access Control in Event Tickets = 5.29.0.1 versions...
CVE-2026-65433
Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg = 1.5.1 versions...
CVE-2026-65435
Unauthenticated Broken Access Control in Thrive Leads Version = 10.9.2 versions...
CVE-2026-59560
Subscriber Broken Access Control in FundEngine = 1.7.8 versions...
CVE-2026-59536
Unauthenticated Broken Access Control in CoCart – Headless ecommerce = 4.8.4 versions...
CVE-2026-59530
Unauthenticated Broken Access Control in Stripe For WooCommerce = 4.0.7 versions...
CVE-2026-59534
Unauthenticated Broken Access Control in Post My CF7 Form = 6.2.0 versions...
CVE-2026-65878
Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder 6.7.1- Improper path validation and ACL checks lead to a file deletion vector in the media manager...