CVE-2026-51745

Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to refresh the primary station list via sending a crafted MQTT message to the csbroker component...

CVE-2026-51761

An incorrect access control flaw in the updateLanIp function of the TOTOLINK T6 router (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to refresh the LAN address state by sending a crafted MQTT message to the cs_broker component. The CVSS 3.1 score is 5.3 (Medium) with Low integr...

CVE-2026-51768

CVE-2026-51768 is an incorrect access control vulnerability in the setElinkQosConfig function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015). An unauthenticated attacker with network access can send a crafted MQTT message to the cs_broker component to modify the privileged QoS policy ...

CVE-2026-51751

CVE-2026-51751 is a critical (CVSS 9.8) incorrect access control vulnerability in the delSlaveDevice function of TOTOLINK T6 (firmware 4.1.5cu.748_B20211015). An unauthenticated network attacker can send a crafted MQTT message to the cs_broker component to remove a specified slave device from loc...

CVE-2026-51764

An incorrect access control flaw in the recvSlaveCloudCheckStatus function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows an unauthenticated remote attacker to overwrite cloud-result tracking files by sending a crafted MQTT message to the cs_broker component. The CVSS 3.1 scor...

CVE-2026-51756

An incorrect access control flaw in the meshSlaveUpgfw function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows an unauthenticated attacker to initiate firmware flashing using existing upgrade files by sending a crafted MQTT message to the cs_broker component. The CVSS 3.1 scor...

CVE-2026-82882

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...

EUVD-2026-66377

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key broken access control...

EUVD-2026-66224

Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute, which maps permissions only to owntimesheet or othertimesheet. As a result, any authenticated user with ROLETEAMLEAD or a role holding editothertimesheet/deleteothertimesheet can read, modify, and...

CVE-2026-82395 Sulu: Media move/update authorization bypass (IDOR)

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check from the client-supplied collection value instead of the media item's actual source collection, and...

CVE-2026-81892

EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions Action::linkToRoute and MenuItem::linkToRoute, swaps the executed controller based on the...

CVE-2026-81762

Subscriber Broken Access Control in Booking and Rental Manager = 2.7.6 versions...

CVE-2026-81758

Subscriber Broken Access Control in OwnerRez API = 1.2.6 versions...

CVE-2026-81296

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...

CVE-2026-81278

Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1...

CVE-2026-50199

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/updateexchange.php loads the first Fixer/API Layer credential globally instead of loading the credential for the authenticated user. As a result, a normal authenticated user without...

CVE-2026-81278

WPExperts Post SMTP WordPress plugin is affected by a Missing Authorization (Settings Change) vulnerability in versions 4.0.0 through 4.0.0-beta.1 . The flaw allows low-privileged users to exploit incorrectly configured access control levels, resulting in low integrity and availability impact wit...

CVE-2026-81278 WordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vulnerability

Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1...

EUVD-2026-68803

Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1...

CVE-2026-81892 EasyAdmin custom-action dispatcher bypasses access_control on other routes

EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions Action::linkToRoute and MenuItem::linkToRoute, swaps the executed controller based on the...