169514 matches found
CVE-2026-65760 Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1
Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system...
Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability
Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network...
Azure API Management (APIM) Remote Code Execution Vulnerability
Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network...
CVE-2026-65531
Unauthenticated Broken Access Control in Qubely = 1.8.14 versions...
CVE-2026-65895 Grav API Plugin before 1.0.10 Broken Access Control
Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential...
CVE-2026-65895 Grav API Plugin before 1.0.10 Broken Access Control
Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential...
PYSEC-2026-3477 LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
Impact LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives. An authenticated user with access to LiteLLM LLM API routes, or a key whose allowedroutes includes /v1/skills, anthropicroutes, or llmapiroutes, could upload a crafted skill archive...
PYSEC-2026-3491 OpenStack Neutron: Neutron port RBAC policy bypass allows project managers to set trusted device owners on shared networks
In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set deviceowner to a value that has "network:" at the beginning "network:dhcp" for example. The default port RBAC policies incorrectly included PROJECTMANAGER without...
WordPress CoCart – Headless ecommerce plugin <= 4.8.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by VanTastic in WordPress Plugin CoCart – Headless ecommerce versions = 4.8.4...
WordPress Thrive Product Manager plugin <= 10.9.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Austin Ginder in WordPress Plugin Thrive Product Manager versions = 10.9.2...
EUVD-2026-48138
Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names = 1.3.3 versions...
CVE-2026-65537
CVE-2026-65537 concerns a WordPress plugin, Cyr to Lat reloaded – transliteration of links and file names , affected in versions
CVE-2026-65537
Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names = 1.3.3 versions...
CVE-2026-65531
Unauthenticated Broken Access Control in Qubely = 1.8.14 versions...
CVE-2026-65531 WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Qubely = 1.8.14 versions...
CVE-2026-65531 WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Qubely = 1.8.14 versions...
EUVD-2026-48132
Unauthenticated Broken Access Control in Qubely = 1.8.14 versions...
EUVD-2026-48131
Subscriber Broken Access Control in TemplateSpare = 4.2.2 versions...