CVE-2026-37073

An incorrect access control vulnerability exists in the Veno File Manager Project 4.4.9 at the /vfm-admin/ajax/sendfiles.php endpoint. This flaw allows an unauthenticated attacker to send emails from the application's configured SMTP server by making a POST request with the required parameters an...

CVE-2026-37067

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request...

CVE-2026-77034: Improper Access Control

Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager 5.0.1 - Any visitor holding their own session token can republish and overwrite an article associated with an event...

PT-2026-82787

go-wind-cms GoWind before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine noop.State, so the authz middleware always allows requests. Any...

CVE-2026-37067

An incorrect access control vulnerability exists in the Veno File Manager Project 4.4.9 within the /vfm-admin/admin-panel/view/save-cvs.php component. This flaw allows an unauthenticated attacker to extract all application logs from a specific date onwards by sending a specially crafted POST requ...

CVE-2026-37072

Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php...

PT-2026-82670

Name of the Vulnerable Software and Affected Versions Veno File Manager Project version 4.4.9 Description Incorrect access control in the '/vfm-admin/admin-panel/view/save-cvs.php' endpoint allows an unauthenticated attacker to extract all application logs from a specified date onwards by sending...

PT-2026-82472

Unauthenticated Broken Access Control in Kali Forms = 2.4.23 versions...

PT-2026-82391

The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is not a Super Admin to download a full backup of the entire network, including every site's data...

PT-2026-82561

The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSION DENIED when createIsWorkspaceMember reports that the caller is not a member of the target workspace, but it does not return. Execution continue...

PT-2026-82386

The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by...

CVE-2026-37072: Improper Access Control

Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php...

PT-2026-82546

Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects T2000: before 31.6...

CVE-2026-16569: Improper Access Control

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber...

CVE-2026-37073

Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMPT server on the application via making a POST request to the endpoint with needed parameters and header...

CVE-2026-37073: Improper Access Control

Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMPT server on the application via making a POST request to the endpoint with needed parameters and header...

CVE-2026-18886: Improper Access Control

ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended, resulting in privilege escalation. ...

CVE-2026-64896: Improper Access Control

Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects T2000: before 31.6...

PT-2026-82784

The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download them...

PT-2026-82653

Name of the Vulnerable Software and Affected Versions ServiceNow AI platform affected versions not specified Description An improper access control issue exists within the ServiceNow AI platform. This flaw allows an unauthenticated user to create or modify instance data beyond intended permission...