PT-2026-79328

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description Improper Access Control in the Kubernetes Service CKS plugin allows cross-tenant manipulation of the Kubernetes cluster during the process of adding and removing nodes...

PT-2026-79307

Name of the Vulnerable Software and Affected Versions Duplicate Post WordPress plugin versions prior to 1.5.6 Description Insufficient validation occurs when duplicating posts, as the plugin fails to verify if the user has permission to read the content before the duplication process. This allows...

CVE-2026-76876: Missing Authorization

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GET request to the settings API endpoint with a valid record...

PT-2026-79496

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 3.2.3 Description Combodo iTop is a web-based IT service management tool. An access control bypass exists in the Object Query Language OQL implementation where the silos access check only protects classes present...

CVE-2026-66797: Improper Access Control

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an entity's UUID is specified, but fail to honor its result correctly. This lets any authenticated user...

CVE-2026-16576: Improper Access Control

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor...

PT-2026-79361

Name of the Vulnerable Software and Affected Versions Reconmap affected versions not specified Description An authorization bypass exists in the API due to a fallback policy in apps/api/app/Program.cs that is bypassed by the AllowAnonymous attribute in apps/api/app/Controllers/ReportsController.c...

PT-2026-79309

Name of the Vulnerable Software and Affected Versions AI Engine versions prior to 3.6.1 Description Insufficient authorization verification during privileged user management operations allows a user with the Administrator role on a Multisite sub-site to take over any account within the network,...

PT-2026-79439

Name of the Vulnerable Software and Affected Versions Craftplan versions prior to 0.5.1 Description Broken access control allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. By sending a GET request to the...

SITI-Navigator Access Control File Upload

The vulnerability of SITI-Navigator software is related to deficiencies in access control. Exploiting this vulnerability allows a remote attacker to upload arbitrary files...

PT-2026-79495

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 3.2.3 Description Improper access control in the 'ajax.render.php' and 'ajax.document.php' endpoints allows unauthorized access to documents by bypassing user permission checks. Recommendations Update to version...

CVE-2026-34836: Missing Authorization

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document access without checking on user permissions. This issue has been fixed in version 3.2.3...

MINI-HQ29-G8XJ-45VF

Bulletin has no description...

MINI-RHRC-55CW-84VG

Bulletin has no description...

CVE-2026-77644

A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability WRR Enterprise Edition...

CVE-2026-72843

The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next without checking the caller, and no customer-session middleware guards the route; the on...

CVE-2026-66309

Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network...

CVE-2026-62945

TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservationid, placeid, and assignmentid values without using findForeignLinkTarget to verify that the referenced object belongs to the file's trip. An authenticated user...

CVE-2026-55489

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting...

CVE-2026-54509

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...