19960 matches found
WordPress WPFunnels plugin <= 3.12.13 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin WPFunnels versions = 3.12.13...
WordPress Business Directory plugin <= 6.4.26 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by nh4tvd in WordPress Plugin Business Directory versions = 6.4.26...
CVE-2026-9853
A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. Only the SYS600 system users should be permitted to view and modify...
EUVD-2026-70320
A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. Only the SYS600 system users should be permitted to view and modify...
CVE-2026-9853
CVE-2026-9853 is a vulnerability in Hitachi Energy's SYS600 application that allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without completing SYS600's own authentication. This effectively bypasses the intended ac...
CVE-2026-85093 Cheshire Cat AI Memory Collection Endpoint Information Disclosure
Cheshire Cat AI's GET /memory/collections/collectionid/points endpoint fails to apply per-user filtering when retrieving episodic memory points. Authenticated attackers with MEMORY:READ permission can retrieve all users' stored conversation messages and personal data by paginating through the...
CVE-2026-85093
Cheshire Cat AI (an open-source AI agent framework) contains an information disclosure vulnerability in its GET /memory/collections/{collection_id}/points endpoint. The root cause is a missing per-user filter when retrieving episodic memory points, allowing any authenticated user with MEMORY:READ...
EUVD-2026-70303
Cheshire Cat AI's GET /memory/collections/collectionid/points endpoint fails to apply per-user filtering when retrieving episodic memory points. Authenticated attackers with MEMORY:READ permission can retrieve all users' stored conversation messages and personal data by paginating through the...
PT-2026-84988
WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted videos through hardcoded visibility flags and an undefined property. Attackers can access the channel endpoint to retrieve sensitive video...
PT-2026-85115
Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents = 1.51.0 versions...
PT-2026-85222
Name of the Vulnerable Software and Affected Versions Worklenz versions prior to 3.0.0 Description An authorization bypass exists when resolving task-scoped API endpoints because the system fails to verify task ownership by organization. This allows authenticated users to access task data belongi...
PT-2026-85036
CRMEB through 6.0.0 fails to validate message ownership in the edit message handler of MessageSystemController.php, allowing authenticated users to modify arbitrary system inbox messages. Attackers can update any message's columns including is del, look, and uid to delete, mark read, or reassign...
PT-2026-84907
Cheshire Cat AI's GET /memory/collections/collection id/points endpoint fails to apply per-user filtering when retrieving episodic memory points. Authenticated attackers with MEMORY:READ permission can retrieve all users' stored conversation messages and personal data by paginating through the...
PT-2026-85098
Unauthenticated Broken Access Control in Mail Mint = 1.31.0 versions...
VulnCheck KEV: CVE-2026-84755
Unauthenticated Broken Access Control in Mail Mint = 1.31.0 versions...
PT-2026-85093
Unauthenticated Broken Access Control in Timetics = 1.0.61 versions...
PT-2026-84989
WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a program id parameter is supplied. Attackers can enumerate playlist identifiers and retrieve unlisted and group-restricted videos by requesting...
PT-2026-85207
LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path...
