CVE-2026-84754: Missing Authorization

Unauthenticated Broken Access Control in WPFunnels = 3.12.13 versions...

CVE-2026-84779: Missing Authorization

Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents = 1.51.0 versions...

CVE-2026-84777: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in Really Simple SSL = 9.8.0 versions...

CVE-2026-82023: Incorrect Authorization

LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path...

PT-2026-85097

Unauthenticated Broken Access Control in WPFunnels = 3.12.13 versions...

PT-2026-85094

Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium 4.46.0 versions...

PT-2026-85101

Unauthenticated Broken Access Control in Business Directory = 6.4.26 versions...

PT-2026-84917

A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. Only the SYS600 system users should be permitted to view and modify...

PT-2026-85113

Unauthenticated Broken Authentication in Really Simple SSL = 9.8.0 versions...

CVE-2026-84847: Missing Authorization

Unauthenticated Broken Access Control in Quick Event Manager = 9.17 versions...

PT-2026-85045

Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy api.py endpoints. Attackers can access other tenants' cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents...

PT-2026-84989

WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a program id parameter is supplied. Attackers can enumerate playlist identifiers and retrieve unlisted and group-restricted videos by requesting...

PT-2026-85222

Name of the Vulnerable Software and Affected Versions Worklenz versions prior to 3.0.0 Description An authorization bypass exists when resolving task-scoped API endpoints because the system fails to verify task ownership by organization. This allows authenticated users to access task data belongi...

Linux Distros Unpatched Vulnerability : CVE-2026-74994

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The modauth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collaps...

PT-2026-84988

WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted videos through hardcoded visibility flags and an undefined property. Attackers can access the channel endpoint to retrieve sensitive video...

VulnCheck KEV: CVE-2026-84755

Unauthenticated Broken Access Control in Mail Mint = 1.31.0 versions...

OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints

Summary The OpenChoreo API server openchoreo-api authorized requests to its exec and wirelogs endpoints against the project supplied by the caller in the request, rather than against the project that actually owns the target component. The target component was resolved by name only, and the...

CVE-2026-8347 — Updated!

CVE-2026-8347 – Insecure Direct Object Reference IDOR in Concrete CMS Overview CVE-2026-8347 is an Insecure Direct Object Reference IDOR vulnerability affecting Concrete CMS versions 9.5.0 and earlier. The issue exists in the Express Association Reorder functionality due to insufficient...

BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Jira Service Management Data Center and Server

This High severity BASM Broken Authentication & Session Management vulnerability known as CVE-2026-59639 was introduced in 10.0.0 and later of Jira Service Management Data Center and Server. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 8.7 and a CVSS...

BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Jira Software Data Center

This High severity BASM Broken Authentication & Session Management vulnerability known as CVE-2026-59639 was introduced in 10.0.0 and later of Jira Software Data Center and Server. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...