Exploit for Improper Access Control in Oracle Http_Server

CVE-2026-21962 — Oracle HTTP Server / WebLogic Server Proxy Pl...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager (CVE-2026-14446)

Summary IBM WebSphere Application Server used by IBM Tivoli System Automation Application Manager and is affected by a privilege escalation vulnerability. Required fixes for affected WebSphere Application Server has been published in the security bulletin links below. Vulnerability Details...

EUVD-2026-66815

disconf Distributed Configuration Management Platform 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these fo...

SUSE CVE-2026-65182

Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from...

SUSE CVE-2026-68525

Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from...

SUSE CVE-2026-79201

Improper access control in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

PT-2026-82389

The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

CVE-2026-37073

Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMPT server on the application via making a POST request to the endpoint with needed parameters and header...

EUVD-2026-67258

Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php...

CVE-2026-37070

Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint...

EUVD-2026-67260

Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint...

PT-2026-82471

Subscriber Broken Access Control in Ditty = 3.1.67 versions...

CVE-2026-37070

The Veno File Manager Project version 4.4.9 is vulnerable to incorrect access control in the /vfm-admin/ajax/streamvid.php endpoint. This flaw allows an authenticated attacker to read any uploaded files belonging to other users by sending a specially crafted GET request while knowing the specific...

PT-2026-82577

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/data sources/views.py are declared with a permission class that admits any caller, so a request carrying no...

CVE-2026-37072

Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php...

CVE-2026-37070: Improper Access Control

Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint...

PT-2026-82425

Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager 5.0.1 - A non-manager can therefore read attendee names, usernames, registration dates and statuses for events they do not manage, including lists belonging to unpublished events...

EUVD-2026-67263

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request...

PT-2026-82390

The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

PT-2026-82766

Improper access control to the Synergis Softwire installation folder. This vulnerability affects Streamvault all-in-one appliances SV-100E and SV-300E series and Synergis Softwire installed on Windows servers...