14011 matches found
PT-2026-66536
Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.8.4 Description Broken access control issues in the file handling API allow unauthorized access to user files, breaking tenant isolation in multi-user deployments. The endpoint '/api/v1/files/images/fl...
WordPress AnsPress – Question and answer plugin 4.4.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Taylsec in WordPress Plugin AnsPress – Question and answer versions 4.4.4...
CVE-2026-14446
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console...
CVE-2026-14446 IBM WebSphere Application Server is affected by a privilege escalation
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console...
CVE-2026-14446
IBM WebSphere Application Server 9.0 and 8.5 are reported vulnerable to broken access control/privilege escalation in the administrative console. The CVSSv3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) yields a base score of 9.8 (CRITICAL). Impact relates to confidentiality, integrity, and avai...
EUVD-2026-50064
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console...
CVE-2026-14446 IBM WebSphere Application Server is affected by a privilege escalation
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console...
CVE-2026-14446
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console...
EUVD-2026-49995
SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs...
CVE-2026-57510 SuperPlane < 0.27.0 Broken Object Level Authorization via CanvasService gRPC
SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs...
EUVD-2026-49876
Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can...
CVE-2026-66750 Let's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files route
Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can...
CVE-2026-66750 Let's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files route
Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can...
WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Bao - BlueRock in WordPress Plugin Ultimate Store Kit Elementor Addons versions = 3.0.5...
EUVD-2026-49658
Unauthenticated Broken Access Control in Ad Invalid Click Protector AICP = 1.3.0 versions...
PT-2026-65598
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console...
PT-2026-65520
Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can...
CVE-2026-66473
Unauthenticated Broken Access Control in Xendit Payment = 7.1.0 versions...