TYPO3-EXT-SA-2026-024: Broken Access Control in extension "femanager" (femanager)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-024...

WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Phat RiO in WordPress Plugin Mobile App for WooCommerce versions = 0.4.62...

Improper access control in the preview links module (see GHSA-q6wp-fr43-gm9v)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-preview-links-module...

Improper access control in the newsletter module (see GHSA-3r9g-pfhv-3228)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-newsletter-module...

Improper access control in the CSV import wizard (see GHSA-23w9-4pg3-xwm3)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-csv-import-wizard...

Improper access control in the table access voter (see GHSA-5974-gfqc-wrcm)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-table-access-voter...

Improper access control in the CSV import wizard (see GHSA-23w9-4pg3-xwm3)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-csv-import-wizard...

Improper access control in the newsletter module (see GHSA-3r9g-pfhv-3228)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-newsletter-module...

Improper access control in the table access voter (see GHSA-5974-gfqc-wrcm)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-table-access-voter...

Improper access control in the preview links module (see GHSA-q6wp-fr43-gm9v)

More info at https://contao.org/en/security-advisories/improper-access-control-in-the-preview-links-module...

Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added a maximum-severity security flaw impacting Oracle HTTP Server and Oracle WebLogic Server to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. The vulnerability, tracked as...

Security Bulletin: Multiple vulnerabilities affect IBM® SDK, Java™ Technology Edition for Content Collector for Email, Content Collector for File Systems and Content Collector for Microsoft SharePoint

Summary IBM SDK, Java Technology Edition Quarterly CPU - Jul 2026 - Includes Oracle July 2026 CPU Critical Patch Update CVE-2026-8400, CVE-2026-41254, CVE-2026-47057, CVE-2026-47063, CVE-2026-47058, CVE-2026-16441, CVE-2026-60147, CVE-2026-46968, CVE-2026-16439, CVE-2026-16243, CVE-2026-47027,...

EUVD-2026-65208

Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the...

CVE-2026-56707 Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to...

CVE-2026-56707

Grav Flex Objects plugin (versions 1.4.0 through 1.4.7 ) contains an authorization bypass in the flex-objects shortcode. Any user with page-edit access can embed the shortcode in a published page to render any registered Flex collection without the permission checks enforced in the admin panel's ...

EUVD-2026-65192

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.29 via the 'resultID' parameter due to missing validation on a user controlled key...

EUVD-2026-65173

Subscriber Broken Access Control in AutomatorWP = 5.8.3 versions...

EUVD-2026-65160

Subscriber Broken Access Control in Style Kits = 2.6.5 versions...

PT-2026-81244

Name of the Vulnerable Software and Affected Versions Events 2 affected versions not specified Description The frontend management plugin contains a broken access control issue. The system attributes a newly created event to the submitting user's organizer record only if the request does not...

PT-2026-81908

Name of the Vulnerable Software and Affected Versions Kimai versions prior to 2.63.0 Description An improper authorization and business logic issue exists in the 'PATCH /api/teams/id' API endpoint. The system removes all current team members before validating the new member list provided in the...