EUVD-2026-81427

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2026-92893

A flaw was found in the foremanansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's viewhosts permission. An authenticated user whose host visibility is restricted by a...

EUVD-2026-81289

Craft CMS 5.0.0 through 5.10.12 fixed in 5.10.13 contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries but without savePeerEntries opens another author's entry in read-only mode, Craft...

EUVD-2026-81285

AVideo through 29.0 commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the API like endpoint, allowing logged-in users to vote on password-protected and group-restricted videos. Attackers can submit like and dislike requests to increment vote counters on...

EUVD-2026-81277

In AVideo through 29.0, the API getapivideo endpoint contains a broken access control vulnerability in the cleantitle branch that returns user-group-restricted videos with owner PII to anonymous callers. Attackers can query videos by their public slug to bypass group restrictions and retrieve...

PT-2026-94284

Unauthenticated Broken Access Control in User Registration = 5.2.7 versions...

PT-2026-94282

Name of the Vulnerable Software and Affected Versions Booking Calendar versions prior to 11.8 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass access restrictions. Recommendations Update to a version newer than 11.7...

PT-2026-94257

Unauthenticated Broken Authentication in Headless Single Sign On = 1.7.0 versions...

PT-2026-94221

Name of the Vulnerable Software and Affected Versions Dell OpenManage Server Administrator versions prior to 11.1.0.3 Description The software uses a broken or risky cryptographic algorithm. This allows an unauthenticated remote attacker to potentially exploit the flaw, resulting in information...

CVE-2026-81438: Use of a Broken or Risky Cryptographic Algorithm

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2026-78528: Missing Authorization

Unauthenticated Broken Access Control in BerqWP = 4.1.15 versions...

CVE-2026-66676: Missing Authorization

Unauthenticated Broken Access Control in Easy Invoice = 2.3.8 versions...

PT-2026-94255

Unauthenticated Broken Authentication in EduAdmin Booking = 5.4.2 versions...

PT-2026-94288

Name of the Vulnerable Software and Affected Versions BerqWP versions prior to 4.1.16 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to version 4.1.16 or later...

CVE-2026-74002: Missing Authorization

Unauthenticated Broken Access Control in Booking Calendar = 11.7 versions...

CVE-2026-74000: Missing Authorization

Contributor Broken Access Control in Simple Membership = 4.8.2 versions...

CVE-2026-62108: Authentication Bypass by Spoofing

Unauthenticated Broken Authentication in Headless Single Sign On = 1.7.0 versions...

CVE-2026-62101: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in EduAdmin Booking = 5.4.2 versions...

CVE-2026-92915: Allocation of Resources Without Limits or Throttling

WWBN AVideo through commit e01e41ecc no patched version available contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement $global'ignoreUserMustBeLoggedIn' = 1, takes usersid directly from the query string, and calls User::sendVerificationLi...

PT-2026-94238

Name of the Vulnerable Software and Affected Versions WWBN AVideo through commit e01e41ecc Description A broken access control flaw exists in the 'objects/userVerifyEmail.php' endpoint. The script disables login requirements via the $global'ignoreUserMustBeLoggedIn' variable and accepts the users...