191569 matches found
CVE-2026-78258 WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Booking and Rental Manager = 2.7.5 versions...
CVE-2026-78291 WordPress RepairBuddy plugin <= 4.1223 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in RepairBuddy = 4.1223 versions...
CVE-2026-78291 WordPress RepairBuddy plugin <= 4.1223 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in RepairBuddy = 4.1223 versions...
CVE-2026-78291
CVE-2026-78291 is an unauthenticated Broken Access Control vulnerability in the WordPress plugin RepairBuddy (also referenced as Computer Repair Shop ), affecting versions 4.1223 and earlier . Discovered by Supakiad S. (m3ez) via Patchstack, the flaw allows a remote, unauthenticated attacker to m...
EUVD-2026-64829
Unauthenticated Broken Access Control in RepairBuddy = 4.1223 versions...
WordPress RepairBuddy plugin <= 4.1223 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Supakiad S. m3ez in WordPress Plugin RepairBuddy versions = 4.1223...
WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Support Pro versions = 2.3.1...
WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Bao - BlueRock in WordPress Plugin Booking and Rental Manager versions = 2.7.5...
Security Bulletin: Multiple vulnerabilities affect IBM Sterling Connect:Direct File Agent
Summary There are vulnerabilities in IBM Semeru Runtime version 17 used by IBM Sterling Connect:Direct File Agent. IBM Sterling Connect:Direct File Agent has addressed the applicable CVEs CVE-2026-41254, CVE-2026-47063, CVE-2026-60147, CVE-2026-46968, CVE-2026-47027, CVE-2026-47021, CVE-2026-4691...
CVE-2026-74595
A flaw was found in the Linux kernel's fscrypt component. When setting an encryption policy on an idmapped mount, the fscryptioctlsetpolicy function incorrectly performs an owner check. This vulnerability can lead to legitimate users being denied access to set encryption policies, while...
WordPress ProLancer Element plugin <= 1.4.8 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Jamaal ahmed in WordPress Plugin ProLancer Element versions = 1.4.8...
BIT-AUTHENTIK-2026-61574 authentik RAC: access any endpoint via an unrelated application
authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Control endpoint list returns every configured endpoint to any authenticated user regardless of which applications the user may access, and the response includes connection settings that can contain...
CVE-2026-19200
Velociraptor 's verify() VQL function suffers from an implementation fault that causes it to use the global artifact repository instead of a scoped one. This allows a user with only the NOTEBOOK_EDIT permission (e.g., an analyst role) to overwrite existing live built-in artifacts without the perm...
CVE-2026-78204
Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...
CVE-2026-78204 Ghostwriter through 7.2.6 Missing Authorization on Report Template Lint Endpoints
Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...
EUVD-2026-64679
Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...
CVE-2026-78204
Ghostwriter through version 7.2.6 is missing per-object authorization on its report template lint endpoints . The underlying cause is that RoleBasedAccessControlMixin.test_func only checks request.user.is_active unless a view explicitly overrides it, and neither the lint endpoint nor the stored-l...
EUVD-2026-64678
Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then...
CVE-2026-78203
Ghostwriter before 7.1.2 contains a cross-client authorization flaw in the report template swap endpoint . The endpoint fails to validate template ownership, and because template primary keys are sequential, an authenticated attacker can enumerate and attach templates belonging to other clients t...
