14057 matches found
EUVD-2026-67234
Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete in htdocs/api/class/apidocuments.class.php calls dolchecksecureaccessdocument with the mode argument 'read' when handling DELETE /api/index.php/documents, while the sibling builddoc path...
EUVD-2026-67230
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to read the titles, tree paths, and conten...
EUVD-2026-67143
The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSIONDENIED when createIsWorkspaceMember reports that the caller is not a member of the target workspace, but it does not return. Execution continues...
EUVD-2026-67127
Affected versions of Flowintel expose the /myassignment/user API endpoint to any authenticated API user. The endpoint accepts a userid parameter identifying the user whose assignments should be returned, but previously had no role restriction beyond general API authentication. As a result, a...
CVE-2026-81819 Flowintel Missing Authorization Allows Regular API Users to View Other Users’ Task Assignments
Affected versions of Flowintel expose the /myassignment/user API endpoint to any authenticated API user. The endpoint accepts a userid parameter identifying the user whose assignments should be returned, but previously had no role restriction beyond general API authentication. As a result, a...
CVE-2026-81658
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...
WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin WpEvently versions = 5.5.0...
WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin WpEvently versions = 5.5.0...
WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ACF Extended versions = 0.9.2.6...
CVE-2026-81279
Subscriber Broken Access Control in Push Notification for Post and BuddyPress = 3.20 versions...
CVE-2026-81274
Subscriber Broken Access Control in Ditty = 3.1.67 versions...
CVE-2026-81272
Editor Broken Access Control in FluentPlayer Pro = 1.3.2 versions...
CVE-2026-81276
Unauthenticated Broken Access Control in Kali Forms = 2.4.23 versions...
CVE-2026-27330
Unauthenticated Broken Access Control in Mobile App for WooCommerce = 0.4.62 versions...
CVE-2026-81274
The WordPress Ditty (News Ticker) plugin (versions
CVE-2026-81276
CVE-2026-81276 affects the Kali Forms WordPress plugin in versions 2.4.23 and earlier . The vulnerability is an unauthenticated Broken Access Control flaw, rated CVSS 5.3 (Medium) with an attack vector of network, low complexity, no required privileges, and a low impact on integrity. The issue wa...
CVE-2026-81274 WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability
Subscriber Broken Access Control in Ditty = 3.1.67 versions...
EUVD-2026-66953
Unauthenticated Broken Access Control in Kali Forms = 2.4.23 versions...