CVE-2026-106603 WordPress HollerBox plugin <= 2.3.14 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Groundhogg HollerBox holler-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HollerBox: from n/a through 2.3.14...

CVE-2026-106603 WordPress HollerBox plugin <= 2.3.14 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Groundhogg HollerBox holler-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HollerBox: from n/a through 2.3.14...

EUVD-2026-94928

Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through 4.18.0...

CVE-2026-19083

Authorization bypass through User-Controlled key vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloud allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects OctoCloud: from 1.12.06 before 1.12.07...

CVE-2026-19083 IDOR in AKIN Software's OctoCloud

Authorization bypass through User-Controlled key vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloud allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects OctoCloud: from 1.12.06 before 1.12.07...

EUVD-2026-94852

Authorization bypass through User-Controlled key vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloud allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects OctoCloud: from 1.12.06 before 1.12.07...

CVE-2026-19083

The OctoCloud software developed by AKIN Software Computer Import-Export Industry and Trade Co. Ltd. is vulnerable to an authorization bypass (CWE-639) caused by a User-Controlled key vulnerability. This flaw allows an attacker to access functionality that is not properly constrained by Access Co...

EUVD-2026-94833

Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 Windows only lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCO...

CVE-2026-104660

Progressive Robot hMailServer versions 6.0.0 through 6.3.5 (Windows) are vulnerable to a missing authorization flaw in its COM objects. The service registers COM classes without DCOM access or launch permissions and fails to use a security descriptor during CoInitializeSecurity, allowing local in...

CVE-2026-104660 Missing Authorization in hMailServer

Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 Windows only lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCO...

EUVD-2026-94823

Unvalidated environments URL allows OAuth authorization code + PKCE verifier theft and account takeover via injected OIDC authority in Ditto Explorer in Eclipse Ditto Ditto Explorer 3.6.0,3.9.7 allows a craft link set an attacker-controlled OIDC authority with autoSso enabled. The UI then...

CVE-2026-107503

In Eclipse Ditto versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7, the Ditto Explorer UI loads its complete environment configuration, including the Ditto API URI and the OpenID Connect OIDC provider settings, from an arbitrary cross-origin URL supplied in the environmentsURL query parameter. It adopt...

CVE-2026-71183

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints. These endpoints fail to enforce the required data source access controls...

CVE-2026-71895

An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the...

CVE-2026-71896

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions. The endpoint fails to enforce the necessary authorization checks before returni...

CVE-2026-66087

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the /dolphinscheduler/projects/projectCode/task-instances/taskInstanceId/stop...

CVE-2026-66082

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects. The affected endpoints check permissions against the supplied projectCode but fail to...

CVE-2026-66084

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to access through the /dolphinscheduler/projects/projectCode/task-definition/code/with-upstream endpoint. The endpoint fails to verify that th...

CVE-2026-71896 Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions. The endpoint fails to enforce the necessary authorization checks before returni...

CVE-2026-71896

An authorization vulnerability exists in Apache DolphinScheduler affecting versions before 3.4.3 . The /dolphinscheduler/users/list-all endpoint fails to properly enforce authorization checks, allowing authenticated users to retrieve account information of other users without required permissions...