CVE-2026-84217 WordPress Classified Listing plugin <= 6.1.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Mamunur Rashid Classified Listing allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Classified Listing: from n/a through 6.1.1...

CVE-2026-84217

CVE-2026-84217 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin Classified Listing by Mamunur Rashid, affecting versions from unknown (n/a) through 6.1.1 . The flaw allows authenticated low-privilege users to access functionality not properly constrained by...

WordPress Classified Listing plugin <= 6.1.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Muhammad Bilal bilalmajid1 in WordPress Plugin Classified Listing versions = 6.1.2...

EUVD-2026-69944

Missing Authorization vulnerability in DimaFreund Rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Rentsyst: from n/a through 2.1.2...

CVE-2026-84835 WordPress Rentsyst plugin <= 2.1.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in DimaFreund Rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Rentsyst: from n/a through 2.1.2...

CVE-2026-84835 WordPress Rentsyst plugin <= 2.1.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in DimaFreund Rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Rentsyst: from n/a through 2.1.2...

CVE-2026-84835

CVE-2026-84835 is a Missing Authorization (Broken Access Control) vulnerability in the DimaFreund Rentsyst WordPress plugin, affecting versions through 2.1.2 . The flaw allows an unauthenticated, remote attacker to exploit incorrectly configured access control security levels, resulting in low co...

WordPress Rentsyst plugin <= 2.1.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by benzdeus in WordPress Plugin Rentsyst versions = 2.1.3...

CVE-2026-84760

CVE-2026-84760 is an unauthenticated Broken Access Control vulnerability in the Ultimate Gift Cards For WooCommerce WordPress plugin, affecting versions

EUVD-2026-69936

Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce = 3.2.9 versions...

CVE-2026-84760 WordPress Ultimate Gift Cards For WooCommerce plugin <= 3.2.9 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce = 3.2.9 versions...

CVE-2026-82223 WordPress WP Event SOlution plugin <= 4.1.22 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Event SOlution = 4.1.22 versions...

EUVD-2026-69933

Unauthenticated Broken Access Control in WP Event SOlution = 4.1.22 versions...

CVE-2026-82223

CVE-2026-82223 affects the WP Event Solution WordPress plugin in versions 4.1.22 and earlier . The vulnerability is an Unauthenticated Broken Access Control flaw, meaning a remote attacker with no prior authentication can bypass access controls. The CVSS 3.1 score is 6.5 (Medium) , with impacts o...

CVE-2026-84808

Kimai (a self-hosted time-tracking application) versions before 2.65.0 are affected by an authorization bypass in the REST API timesheet collection endpoint. The vulnerability stems from a failure to enforce activity-team access controls : a user holding the view_other_timesheet permission can li...

CVE-2026-84808 Kimai before 2.65.0 Authorization Bypass via API Timesheet

Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with viewothertimesheet permission can list timesheets using activities restricted to teams they do not belong to,...

EUVD-2026-69918

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending...

EUVD-2026-69917

Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/id/preferences endpoint. Although the web interface gates these employment-contract fields behind the contractotherprofile admin permission, the...

EUVD-2026-69904

Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized...

CVE-2026-84792

Craft CMS versions before 5.10.11 are affected by a broken access control vulnerability in the element-indexes/save-elements endpoint. An attacker with control panel access and limited section permissions can overwrite the sectionId attribute after the initial authorization check, bypassing the d...