19856 matches found
CVE-2026-89151
Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature...
CVE-2026-62136: Missing Authorization
Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce = 2.3.21 versions...
CVE-2026-27378: Missing Authorization
Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce = 3.1.0 versions...
PT-2026-89780
The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site...
PT-2026-90034
Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce = 2.3.21 versions...
PT-2026-90519
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The application implements a fail-open access control mechanism in its role-authorization lookup. When a request handler's name is missing from the role...
CVE-2026-62135: Missing Authorization
Unauthenticated Broken Access Control in Booktics = 1.0.24 versions...
CVE-2026-62132: Missing Authorization
Subscriber Broken Access Control in Masteriyo - LMS = 3.4.0 versions...
CVE-2026-62114: Missing Authorization
Unauthenticated Broken Access Control in Passster = 4.3.13 versions...
PT-2026-90001
Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups method in concrete/src/Api/Controller/Groups.php registers a permissions checker callback that unconditionally returns true, so no per-object tree node authorization is...
PT-2026-90030
Subscriber Broken Access Control in Masteriyo - LMS = 3.4.0 versions...
PT-2026-90029
Unauthenticated Broken Access Control in Passster = 4.3.13 versions...
PT-2026-89996
Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization; the Concrete CMS REST API's Express entry collection endpoint disabled the per-entry view permission check. An OAuth token with read scope for an Express entity could enumerate...
PT-2026-90510
ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse Events=View and/or Snapshots=View permissions to directly fetch media for events belonging to monitors they are n...
PT-2026-90017
Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce = 3.1.0 versions...
PT-2026-90523
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An improper access control issue exists in a deployment mode designed to provide read-only access to a bundled packet-analysis component's interface. The system...
PT-2026-89789
The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failure, allowing unauthenticated users to disclose guest order information and to change the status of, or trash...
PT-2026-90151
Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3 Description An object-level authorization failure occurs when updating a Page Type. The Types::submit dashboard controller processes the ptID variable provided by the user to load and save a Page Type witho...
PT-2026-90545
Title Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component Description A lack of authorization control was discovered in the stockAction method in packages/admin/src/Livewire/Components/Products/VariantStock.php. The component exposes a public $variant...