19994 matches found
PT-2026-84671
Craft CMS versions = 5.0.0-RC1 and 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite. The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft which only...
PT-2026-84702
Name of the Vulnerable Software and Affected Versions Broken Link Checker versions prior to 2.4.15 Description An Editor Server Side Request Forgery SSRF exists in the plugin. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location,...
PT-2026-84743
The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission which doesn’t allow changing...
PT-2026-84603
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or super admin. On ...
PT-2026-84783
A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b 67ea 11b 152 and earlier causes downstream builds triggered by the build step to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream job...
PT-2026-84631
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other...
CVE-2026-82223: Missing Authorization
Unauthenticated Broken Access Control in WP Event SOlution = 4.1.22 versions...
PT-2026-84719
The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members...
PT-2026-84672
Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revisionCreator fields. Attackers with a scoped GraphQL token can query these relations to read usernames, email addresses, and full names of a...
TYPO3 CMS - Broken Access Control in Backend and Install Tool
Problem The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 CVE-2020-11069 became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Admin Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originat...
GHSA-68JX-F42C-7599 TYPO3 CMS - Broken Access Control in Backend and Install Tool
Problem The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 CVE-2020-11069 became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Admin Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originat...
CVE-2026-73758 Authenticated Privilege Escalation Vulnerability via Broken Access Control in AOS-CX
A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system...
CVE-2026-73758 Authenticated Privilege Escalation Vulnerability via Broken Access Control in AOS-CX
A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system...
CVE-2026-73758
CVE-2026-73758 is an authenticated privilege escalation vulnerability in the API endpoint of HPE AOS-CX (Aruba OS for switching), caused by broken access control . A low-privilege operator user with valid credentials can change the state of certain system settings, rated CVSS 6.5 (Medium) with a ...
CVE-2026-73741
A vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to view some system files. Successful exploitation could allow an attacker to access limited data beyond what is authorized by the user's existing privilege level...
CVE-2026-73714
A sensitive information disclosure vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to access data beyond what is authorized by the user's existing privilege level, potentially leading to further...
CVE-2026-72641
Incorrect Authorization CWE-863 in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only Security Solution read access in a Kibana space could enumerate and change the state of Entity Store...
EUVD-2026-69468
A vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to view some system files. Successful exploitation could allow an attacker to access limited data beyond what is authorized by the user's existing privilege level...
CVE-2026-73730 Authenticated Privilege Escalation via Broken Access Control in HPE Networking Fabric Composer API
A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system...
CVE-2026-73730
A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer , caused by broken access control . An authenticated low-privilege operator user can change the state of certain system settings, resulting in high integrity impact without affecting confidentiality or availa...