CVE-2026-12689

The ProfileGrid WordPress plugin before 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing authenticated users with Subscriber-level access and above to soft-delete, tamper with the metadata of, and mark as read other users' priva...

EUVD-2026-48509

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers ...

CVE-2026-12689

The ProfileGrid WordPress plugin before 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing authenticated users with Subscriber-level access and above to soft-delete, tamper with the metadata of, and mark as read other users' priva...

CVE-2026-12689 ProfileGrid < 5.9.9.7 - Subscriber+ Cross-User Private Message Thread Deletion and Tampering via Missing Authorization

The ProfileGrid WordPress plugin before 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing authenticated users with Subscriber-level access and above to soft-delete, tamper with the metadata of, and mark as read other users' priva...

CVE-2026-12689

ProfileGrid WordPress plugin before 5.9.9.7 lacks authorization/ownership checks for certain private-message thread actions, allowing Subscriber+ authenticated users to soft-delete, tamper with metadata, or mark as read other users’ threads. Affected: ProfileGrid plugin; root cause: missing acces...

EUVD-2026-48490

The ProfileGrid WordPress plugin before 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing authenticated users with Subscriber-level access and above to soft-delete, tamper with the metadata of, and mark as read other users' priva...

EUVD-2026-48454

Improper authorization in Azure Red Hat OpenShift ARO allows an authorized attacker to elevate privileges over a network...

CVE-2026-58275

Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-56160

Improper authorization in Azure Red Hat OpenShift ARO allows an authorized attacker to elevate privileges over a network...

EUVD-2026-48460

Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-58275

Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network...

PT-2026-64270

The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to grant EventON...

PT-2026-64256

In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The shared router configuration used Chi's middleware.StripSlashes,...

PT-2026-71915

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.39.24 Description An issue exists where the endpoint "/api/public/v1/roles/assign" calls the validateGlobalRoleUpdate function without verifying the appBuilder.appId or role.appId variables. This allows an app-scop...

PT-2026-64376

Name of the Vulnerable Software and Affected Versions sysPass versions prior to 3.2.12 Description A missing object-level authorization issue exists in the JSON-RPC API. This allows holders of API tokens to enumerate account metadata, overwrite passwords, and delete accounts across the entire...

PT-2026-64428

Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description A flaw exists where libsoup incorrectly attaches the Proxy-Authorization header to HTTPS requests sent through a CONNECT tunnel established via an HTTP proxy. This behavior allows the...

Apache Syncope permission granting and access control issues

Apache Syncope is an open-source identity management and governance system that primarily provides features for user management, permission control, and role assignment. Apache Syncope has a security vulnerability that arises from the improper validation of authorization for users who register or...

PT-2026-64411

Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network...

Zimbra Collaboration Server 10.1.x < 10.1.20 Multiple Vulnerabilities

According to its self-reported version number, Zimbra Collaboration Server is affected by multiple vulnerabilities, including: - A remote code execution vulnerability exists when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of...

PT-2026-71721

Name of the Vulnerable Software and Affected Versions OpenDJ versions prior to 5.1.2 Description The SASL PLAIN authorization identity path in the PlainSASLMechanismHandler.java file fails to evaluate the mayProxy proxy ACI Access Control Instruction scope when an authorization identity resolves ...