19888 matches found
EUVD-2026-75233
Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring...
EUVD-2026-75208
In RuoYi-Cloud-Plus = 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive...
CVE-2026-84821: Missing Authorization
Unauthenticated Broken Access Control in WP Fast Total Search = 1.82.284 versions...
CVE-2026-81785: Missing Authorization
Unauthenticated Broken Access Control in BuddyForms = 2.9.0 versions...
PT-2026-89439
Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions...
PT-2026-89370
Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device Wi-Fi configuration information through these interfaces...
PT-2026-89404
OpenPanel share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters, and breakdown...
PT-2026-89293
The zipMoneyZip Co Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options...
PT-2026-89450
Unauthenticated Broken Access Control in WP Fast Total Search = 1.82.284 versions...
PT-2026-89438
Name of the Vulnerable Software and Affected Versions Salon booking system versions prior to 10.31.9 Description Salon booking system contains a missing authorization flaw that allows the exploitation of incorrectly configured access control security levels. Recommendations Update to version...
PT-2026-89441
Name of the Vulnerable Software and Affected Versions WP Travel versions prior to 12.0.4 Description An authentication bypass issue exists via an alternate path or channel, which allows for password recovery exploitation. Recommendations Update to version 12.0.4 or later...
CVE-2026-81794: Missing Authorization
Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions...
CVE-2026-81793: Missing Authorization
Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a through 10.31.9...
CVE-2026-81788: Missing Authorization
Subscriber Broken Access Control in IMPress for IDX Broker = 3.3.0 versions...
CVE-2026-81787: Authentication Bypass Using an Alternate Path or Channel
Unauthenticated Broken Authentication in IMPress for IDX Broker = 3.3.0 versions...
PT-2026-89432
Unauthenticated Broken Access Control in BuddyForms = 2.9.0 versions...
CVE-2026-81786: Missing Authorization
Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce = 1.2.2 versions...
PT-2026-89442
Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce = 4.6.4 versions...