CVE-2026-90904

Joomla Extension - joomshaper.com - Broken Access Control ACL Bypass in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level ACL permission checks. Any authenticated...

CVE-2026-76648

CopyAPIView awx/awx/api/generics.py:873 sets permissionclasses = IsAuthenticated,, so DRF's getobject performs no object-level RBAC. The get handler lines 988–991 explicitly guards with request.user.canaccessobj.class, 'read', obj — but post lines 1001–1010 does not. POST only checks:...

CVE-2026-76089

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level...

CVE-2026-90904

The Easy Store extension (versions 1.0.0-3.0.0 ) by joomshaper.com contains a Broken Access Control vulnerability. The allowEdit() method in ApiController.php hardcodes a return true; statement, which bypasses Joomla's component-level and asset-level ACL permission checks . This allows any authen...

EUVD-2026-85550

Joomla Extension - joomshaper.com - Broken Access Control ACL Bypass in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level ACL permission checks. Any authenticated...

EUVD-2026-85538

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level...

CVE-2026-76648

The Red Hat Ansible Automation Platform 2.7 (and its automation-controller) is vulnerable to a missing authorization check in the CopyAPIView component (located at awx/awx/api/generics.py:873). While the get() handler performs explicit read permission checks, the post() handler (lines 1001–1010) ...

EUVD-2026-85533

CopyAPIView awx/awx/api/generics.py:873 sets permissionclasses = IsAuthenticated,, so DRF's getobject performs no object-level RBAC. The get handler lines 988–991 explicitly guards with request.user.canaccessobj.class, 'read', obj — but post lines 1001–1010 does not. POST only checks:...

CVE-2026-86867

Cinnamon's Kotaemon all versions up to and including v0.12.0 multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and improper access controls. There are four handler methods in libs/ktem/ktem/pages/chat/control.py that load a Conversation record by its ID...

CVE-2026-95604

The Loops & Logic WordPress plugin is vulnerable to an unauthenticated Broken Access Control flaw in versions

CVE-2026-95604 WordPress Loops & Logic plugin <= 4.2.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...

EUVD-2026-85507

Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...

CVE-2026-95604 WordPress Loops & Logic plugin <= 4.2.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...

CVE-2026-95527

The Conekta Payment Gateway WordPress plugin, versions

EUVD-2026-85495

Unauthenticated Broken Access Control in Conekta Payment Gateway = 6.2.4 versions...

CVE-2026-95527 WordPress Conekta Payment Gateway plugin <= 6.2.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Conekta Payment Gateway = 6.2.4 versions...

CVE-2026-95527 WordPress Conekta Payment Gateway plugin <= 6.2.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Conekta Payment Gateway = 6.2.4 versions...

CVE-2026-95513

The Online Booking & Scheduling Calendar for WordPress by vcita plugin, affecting versions

EUVD-2026-85488

Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita = 4.6.0 versions...

CVE-2026-95513 WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.6.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita = 4.6.0 versions...