169555 matches found
CVE-2026-81284
CVE-2026-81284 affects the WordPress plugin ACF Extended in versions
CVE-2026-81284 WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability
Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...
WordPress OwnerRez API plugin <= 1.2.6 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by JunHee CHO in WordPress Plugin OwnerRez API versions = 1.2.6...
WordPress Booking and Rental Manager plugin <= 2.7.6 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin Booking and Rental Manager versions = 2.7.6...
Chromium: CVE-2026-79201 Improper access control in Workers
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
CVE-2026-82245
Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete license keys or manipulate offline tokens. Attackers with basic user privileges can access /api/global/license/ endpoints to disable premium features and...
CVE-2026-82239
Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table regardless of configured permissions. Attackers with BASIC role can submit crafted query request...
CVE-2026-81578
An improper access control vulnerability (CWE-306) in the web management interface of PaperCut MF and PaperCut NG allows unauthenticated remote attackers to trigger administrative backend actions before access validation completes, enabling modification of system configurations. The root cause in...
EUVD-2026-67713
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allow...
CVE-2026-81578 PaperCut MF/NG: Authentication Bypass
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allow...
CVE-2026-81578 PaperCut MF/NG: Authentication Bypass
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allow...
EUVD-2026-67697
Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete license keys or manipulate offline tokens. Attackers with basic user privileges can access /api/global/license/ endpoints to disable premium features and...
CVE-2026-82245 Budibase before 3.41.3 Missing Authorization License Management
Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete license keys or manipulate offline tokens. Attackers with basic user privileges can access /api/global/license/ endpoints to disable premium features and...
EUVD-2026-67691
Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table regardless of configured permissions. Attackers with BASIC role can submit crafted query request...
CVE-2026-82239
Budibase versions before 3.41.3 are affected by an authorization bypass in the POST /api/datasources/query endpoint. The failure to enforce per-table role restrictions allows users with the low-privilege BASIC role to submit crafted query requests targeting arbitrary table identifiers, enabling t...
CVE-2026-82239 Budibase before 3.41.3 Authorization Bypass via datasources/query
Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table regardless of configured permissions. Attackers with BASIC role can submit crafted query request...
CVE-2026-73208
An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim...
EUVD-2026-67680
An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim...
CVE-2026-40205
An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths accept a token that carries only one of them, while the local token validation path correctly...
WordPress Simple Payment plugin <= 2.5.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by JunHee CHO in WordPress Plugin Simple Payment versions = 2.5.2...