CVE-2026-78291: Missing Authorization

Unauthenticated Broken Access Control in RepairBuddy = 4.1223 versions...

CVE-2026-67204: Incorrect Authorization

BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints. Attackers can supply a...

PT-2026-79797

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.test func returns only request.user.is active unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

PT-2026-80864

RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to remain private. The /export/ endpoint permits selected internal databases to be exported without requiring authentication. While...

IndexedDB DoS

The vulnerability of IndexedDB in web browsers such as Firefox, Firefox ESR, and the email client Thunderbird is related to deficiencies in access control within isolated environments. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

Grafana Access Control Privilege Escalation

The vulnerability of the Grafana monitoring and observation platform, related to access control deficiencies. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

WebRender DoS

The vulnerability of the WebRender component in Firefox web browsers, Firefox ESR, and the email client Thunderbird is related to deficiencies in access control in isolated environments. Exploiting this vulnerability could allow a malicious actor to cause service failures...

WebRender DoS

The vulnerability of the WebRender component in Firefox web browsers, Firefox ESR, and the email client Thunderbird is related to deficiencies in access control in isolated environments. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Telemetry DoS

The vulnerability of the Telemetry component in Firefox web browsers, Firefox ESR, and the Thunderbird email client is related to deficiencies in access control in isolated environments. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

Firefox Thunderbird Access Control DoS

The vulnerabilities of the Firefox web browser, Firefox ESR, and the Thunderbird email client are related to deficiencies in access control within isolated environments. Exploiting these vulnerabilities can allow a malicious actor to cause service failures...

CVE-2026-78272: Missing Authorization

Subscriber Broken Access Control in Fluent Support Pro = 2.3.1 versions...

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and...

rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure

...

Exploit for CVE-2026-66916

Password-Protected Category Bypass via JSON Format in JoomGall...

CVE-2026-77116

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

EUVD-2026-64639

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

CVE-2026-77116 Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup Disclosure via Preview

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

CVE-2026-77116 Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup Disclosure via Preview

Brave Popup Builder slug: brave-popup-builder has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Customer is enough — can read popup content they shouldn't have access to by passing a post ID in the URL...

CVE-2026-77116

The Brave Popup Builder WordPress plugin (slug: brave-popup-builder ) is vulnerable to a broken access control issue in versions through 0.8.5 . An authenticated user with Subscriber or WooCommerce Customer privileges can read restricted popup content by providing a specific post ID in the URL. T...

EUVD-2026-64636

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products...