CVE-2026-104116

A missing authorization check in the illumos zones statistics daemon (zonestatd) allows an unprivileged local user in any zone to disrupt zonestat in other zones and enumerate running zones. The vulnerability resides in the zsd_server() procedure within usr/src/cmd/zonestat/zonestatd/zonestatd.c,...

CVE-2026-104116 Missing authorization in illumos zonestatd allows local users to disrupt zonestat and enumerate running zones

A missing authorization check in the illumos zones statistics daemon zonestatd allows a local user in any zone to disrupt zonestat in other zones and to determine which zones are running. The zonestatd door server procedure, zsdserver in usr/src/cmd/zonestat/zonestatd/zonestatd.c, handles the...

CVE-2026-104117 Missing authorization in illumos ipmgmtd allows local users to change persistent IPMP group membership

A missing authorization check in the illumos IP management daemon ipmgmtd allows a local user to change the persistent IP multipathing IPMP configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmtdoor.c does not require the solaris.network.interface.config...

EUVD-2026-95798

A missing authorization check in the illumos IP management daemon ipmgmtd allows a local user to change the persistent IP multipathing IPMP configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmtdoor.c does not require the solaris.network.interface.config...

CVE-2026-104117

A missing authorization check in the illumos IP management daemon (ipmgmtd ) allows an unprivileged local user to modify the persistent IP multipathing (IPMP) configuration. Specifically, the door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c fails to require solaris.network.in...

CVE-2026-104117 Missing authorization in illumos ipmgmtd allows local users to change persistent IPMP group membership

A missing authorization check in the illumos IP management daemon ipmgmtd allows a local user to change the persistent IP multipathing IPMP configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmtdoor.c does not require the solaris.network.interface.config...

WordPress Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion vulnerability

Missing Authorization to Authenticated Custom+ Arbitrary Academy Comment Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin Academy LMS versions = 4.0.3...

GHSA-PFVF-FWFP-25MP Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy

Summary PermissionExtension.resolve evaluates the return value of haspermission for truthiness on the synchronous path. supportssync only classifies a permission as asynchronous when haspermission is declared with async def via inspect.iscoroutinefunction, so a plain def that returns an awaitable...

Incorrect Authorization

Overview strawberry-graphql is an A library for creating GraphQL APIs Affected versions of this package are vulnerable to Incorrect Authorization via the synchronous resolve method in strawberry/permission.py when a haspermission method is defined as a plain def that returns a coroutine awaitable...

CVE-2026-62028

Missing Authorization vulnerability in bPlugins Before After Image Comparison – Image comparison for WP before-after-image-compare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Before After Image Comparison – Image comparison for WP: from n/a through...

CVE-2026-105883

Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Th Shop Mania: from n/a through 1.9.1...

CVE-2026-104079

Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users to create and publish Envira galleries without the required capabilities, because the endpoint only checks edit permissions on...

CVE-2026-87846

The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's...

CVE-2026-62042

Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scripts n Styles: from n/a through 3.5.8...

CVE-2026-62041

Missing Authorization vulnerability in Ashok Dudhat WP Event Manager wp-event-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Manager: from n/a through 3.4.1...

CVE-2026-39779

Missing Authorization vulnerability in Asgaros Asgaros Forum asgaros-forum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asgaros Forum: from n/a through 3.4.0...

CVE-2026-62040

Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.1...

EUVD-2026-95746

Missing Authorization vulnerability in bPlugins Before After Image Comparison – Image comparison for WP before-after-image-compare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Before After Image Comparison – Image comparison for WP: from n/a through...

CVE-2026-62028

The Before After Image Comparison – Image comparison for WP WordPress plugin (versions

EUVD-2026-95744

Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Th Shop Mania: from n/a through 1.9.1...