PT-2026-82469

Editor Broken Access Control in FluentPlayer Pro = 1.3.2 versions...

CVE-2026-81279: Missing Authorization

Subscriber Broken Access Control in Push Notification for Post and BuddyPress = 3.20 versions...

CVE-2026-81573: Improper Access Control

If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers. An attacker can read potentially...

CVE-2026-37073

Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMPT server on the application via making a POST request to the endpoint with needed parameters and header...

CVE-2026-77034: Improper Access Control

Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager 5.0.1 - Any visitor holding their own session token can republish and overwrite an article associated with an event...

PT-2026-82474

Subscriber Broken Access Control in Push Notification for Post and BuddyPress = 3.20 versions...

CVE-2026-81276: Missing Authorization

Unauthenticated Broken Access Control in Kali Forms = 2.4.23 versions...

PT-2026-82670

Name of the Vulnerable Software and Affected Versions Veno File Manager Project version 4.4.9 Description Incorrect access control in the '/vfm-admin/admin-panel/view/save-cvs.php' endpoint allows an unauthenticated attacker to extract all application logs from a specified date onwards by sending...

PT-2026-82441

Name of the Vulnerable Software and Affected Versions Mobile App for WooCommerce versions prior to 0.4.63 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions within the application. Recommendations Update to a version newe...

CVE-2026-37072

Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php...

EUVD-2026-67263

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request...

EUVD-2026-67260

Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint...

PT-2026-82577

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/data sources/views.py are declared with a permission class that admits any caller, so a request carrying no...

PT-2026-82675

Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php...

CVE-2026-37072

Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php...

The vulnerability of the Imperative Web Server component of the Oracle Helidon library in the Oracle Fusion Middleware software platform allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Imperative Web Server component of the Oracle Fusion Middleware library set is related to access control deficiencies. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

PT-2026-82766

Improper access control to the Synergis Softwire installation folder. This vulnerability affects Streamvault all-in-one appliances SV-100E and SV-300E series and Synergis Softwire installed on Windows servers...

CVE-2026-37073

An incorrect access control vulnerability exists in the Veno File Manager Project 4.4.9 at the /vfm-admin/ajax/sendfiles.php endpoint. This flaw allows an unauthenticated attacker to send emails from the application's configured SMTP server by making a POST request with the required parameters an...

CVE-2026-64896: Improper Access Control

Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects T2000: before 31.6...

PT-2026-82787

go-wind-cms GoWind before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine noop.State, so the authz middleware always allows requests. Any...