CVE-2026-66647: Missing Authorization

Subscriber Broken Access Control in Homlisti = 3.1.2 versions...

PT-2026-80240

Impact The only authorization gate on the duplicate flow is PageAdmin.has add permission, which checks user can add pageuser, site / user can add subpage... — i.e. “may this user create a page at all”. Nothing checks the user’s relationship to the page being copied: - cms/admin/forms.py —...

PT-2026-80221

Summary The clipboard copy paths of the copy plugins admin endpoint validate only the target the user's own clipboard and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the secret content. Details In...

CVE-2025-53999: Missing Authorization

Unauthenticated Broken Access Control in Altair = 5.2.2 versions...

CVE-2026-77026: Client-Side Enforcement of Server-Side Security

Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions...

Access Control Bypass

Overview org.springframework.security:spring-security-core is a package that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Access Control Bypass in the InetAddressMatchers process. An attacker can bypass network-based access control...

PT-2026-78921

Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions...

PT-2026-80770

Name of the Vulnerable Software and Affected Versions Wagtail versions prior to 7.0.9 Wagtail versions prior to 7.3.4 Wagtail versions prior to 7.4.3 Wagtail versions prior to 8.0rc2 Description The internal Pages admin API returns page fields declared in api fields without sufficient access...

PT-2026-79506

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.6 Description The plugin fails to enforce per-object ownership checks on its course content type. This allows users with the instructor role to access and read the content of private courses created by other...

ROS-20260820-73-0004

The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...

PT-2026-79191

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 3.0.29 Description Presenters can submit a presentationId through the '/api/graphql' endpoint that identifies a presentation belonging to a different meeting. The RemovePresentationPubMsgHdlr.scala function fail...

PT-2026-79090

Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.8 Description The copy plugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The copy plugin to clipboard and copy placeholder to clipboard paths accept source placeholder...

PT-2026-79202

Name of the Vulnerable Software and Affected Versions Azure SQL Database affected versions not specified Description Improper access control allows an authorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer version that contai...

ROS-20260820-73-0003

The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2026-74021: Missing Authorization

Unauthenticated Broken Access Control in Chaplin = 2.6.8 versions...

PT-2026-79188

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...

CVE-2026-66595: Missing Authorization

Unauthenticated Broken Access Control in WP Data Access = 5.5.80 versions...

PT-2026-80755

Name of the Vulnerable Software and Affected Versions Winter CMS versions prior to 1.2.13 Description The backend FileUpload form widget improperly trusts the file id POST parameter when resolving attachments. The getFileRecord function resolves the provided ID against the global system files tab...

CVE-2026-77644: Missing Authentication for Critical Function

A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability WRR Enterprise Edition...

PT-2026-79000

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9...