PT-2026-85121

Unauthenticated Broken Access Control in Quick Event Manager = 9.17 versions...

CVE-2026-84215: Missing Authorization

Unauthenticated Broken Access Control in Timetics = 1.0.61 versions...

CVE-2026-84238: Missing Authorization

Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium 4.46.0 versions...

CVE-2026-85157: Exposure of Sensitive Information to an Unauthorized Actor

WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a programid parameter is supplied. Attackers can enumerate playlist identifiers and retrieve unlisted and group-restricted videos by requesting...

CVE-2026-84758: Missing Authorization

Unauthenticated Broken Access Control in Business Directory = 6.4.26 versions...

CVE-2026-84755: Missing Authorization

Unauthenticated Broken Access Control in Mail Mint = 1.31.0 versions...

CVE-2026-84754: Missing Authorization

Unauthenticated Broken Access Control in WPFunnels = 3.12.13 versions...

CVE-2026-84779: Missing Authorization

Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents = 1.51.0 versions...

CVE-2026-84777: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in Really Simple SSL = 9.8.0 versions...

CVE-2026-82023: Incorrect Authorization

LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path...

PT-2026-85097

Unauthenticated Broken Access Control in WPFunnels = 3.12.13 versions...

PT-2026-85094

Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium 4.46.0 versions...

PT-2026-85101

Unauthenticated Broken Access Control in Business Directory = 6.4.26 versions...

PT-2026-84917

A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. Only the SYS600 system users should be permitted to view and modify...

PT-2026-85113

Unauthenticated Broken Authentication in Really Simple SSL = 9.8.0 versions...

CVE-2026-84847: Missing Authorization

Unauthenticated Broken Access Control in Quick Event Manager = 9.17 versions...

PT-2026-85045

Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy api.py endpoints. Attackers can access other tenants' cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents...

Linux Distros Unpatched Vulnerability : CVE-2026-74994

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The modauth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collaps...

OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints

Summary The OpenChoreo API server openchoreo-api authorized requests to its exec and wirelogs endpoints against the project supplied by the caller in the request, rather than against the project that actually owns the target component. The target component was resolved by name only, and the...

CVE-2026-8347 — Updated!

CVE-2026-8347 – Insecure Direct Object Reference IDOR in Concrete CMS Overview CVE-2026-8347 is an Insecure Direct Object Reference IDOR vulnerability affecting Concrete CMS versions 9.5.0 and earlier. The issue exists in the Express Association Reorder functionality due to insufficient...