CVE-2026-47129 NextCRM has Broken Access Control in Server Actions that allows any authenticated user to deactivate/activate arbitrary accounts

NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Access Control BAC vulnerability in the activateUser and deactivateUser Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the admin role...

CVE-2026-47129 NextCRM has Broken Access Control in Server Actions that allows any authenticated user to deactivate/activate arbitrary accounts

NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Access Control BAC vulnerability in the activateUser and deactivateUser Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the admin role...

CVE-2026-47129 NextCRM has Broken Access Control in Server Actions that allows any authenticated user to deactivate/activate arbitrary accounts

NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Access Control BAC vulnerability in the activateUser and deactivateUser Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the admin role...

EUVD-2026-46027

A CSRF vulnerability exists in the zone-include.php script in Revive Adserver 6.0.7. Linking and unlinking banners or campaigns to zones could be triggered via crafted GET or POST requests without any verification of the CSRF token, allowing an attacker to perform these actions on behalf of an...

CVE-2026-28220

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, issues in the Cluster Distributed API DAPI handling allow a cluster peer, or any actor able to authenticate to the cluster channel using the shared cluster key, to make the maste...

CVE-2026-21824

HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations...

EUVD-2026-45978

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, issues in the Cluster Distributed API DAPI handling allow a cluster peer, or any actor able to authenticate to the cluster channel using the shared cluster key, to make the maste...

CVE-2026-28220 Wazuh cluster DAPI arbitrary callable deserialization and RBAC context injection allow a cluster peer to execute privileged functions on the master node

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, issues in the Cluster Distributed API DAPI handling allow a cluster peer, or any actor able to authenticate to the cluster channel using the shared cluster key, to make the maste...

CVE-2026-28220

CVE-2026-28220 concerns the Wazuh Cluster Distributed API (DAPI). Before version 4.14.5, the master node could be coerced to deserialize an attacker-controlled callable and run it under an attacker-controlled RBAC context due to a permissive as_wazuh_object() deserialization and client-supplied r...

CVE-2026-21824 A privilege escalation vulnerability affects HCL Commerce

HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations...

EUVD-2026-45974

HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations...

CVE-2026-21824

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-44359: Improper Control of Generation of Code

Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's mainmatrix.yml workflow is triggered by pullrequesttarget and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated...

PT-2026-66643

Summary In the composable astro/hono pipeline, the security.checkOrigin protection is only installed by the middleware primitive. The actions and pages primitives each dispatch to user code independently, so a pipeline that mounts either primitive before or without middleware will bypass the orig...

PT-2026-61597

Name of the Vulnerable Software and Affected Versions HCL Commerce affected versions not specified Description A privilege escalation issue exists that could enable an attacker to perform unauthorized administrative operations, cause a denial of service, or disclose personal data of users...

CVE-2026-47129: Missing Authorization

NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Access Control BAC vulnerability in the activateUser and deactivateUser Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the admin role...

CVE-2026-12972: Improper Access Control

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to tamper with the payment-related metadata of arbitrary WooCommerce orders...

PT-2026-61716

Name of the Vulnerable Software and Affected Versions NextCRM versions prior to 0.12.0 Description NextCRM contains a Broken Access Control BAC issue, which occurs when a system fails to properly enforce restrictions on what authenticated users are allowed to do. The application does not verify i...

CVE-2026-44359 Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow

Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's mainmatrix.yml workflow is triggered by pullrequesttarget and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the OAuth Credential Revoke Handler component. An attacker can gain unauthorized access or perform unauthorized actions by sending crafted requests remotely. Remediation There is no fixed version for django-jet...