19998 matches found
PT-2026-84386
Incorrect Authorization CWE-863 in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only Security Solution read access in a Kibana space could enumerate and change the state of Entity Store...
CVE-2026-82882
Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application paramete...
EUVD-2026-66377
A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key broken access control...
EUVD-2026-66224
Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute, which maps permissions only to owntimesheet or othertimesheet. As a result, any authenticated user with ROLETEAMLEAD or a role holding editothertimesheet/deleteothertimesheet can read, modify, and...
CVE-2026-82225
Unauthenticated Broken Authentication in RegistrationMagic = 6.0.9.8 versions...
CVE-2026-81758
Subscriber Broken Access Control in OwnerRez API = 1.2.6 versions...
CVE-2026-81762
Subscriber Broken Access Control in Booking and Rental Manager = 2.7.6 versions...
CVE-2026-81296
Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack = 6.2.12 versions...
CVE-2026-50199
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, endpoints/currency/updateexchange.php loads the first Fixer/API Layer credential globally instead of loading the credential for the authenticated user. As a result, a normal authenticated user without...
EUVD-2026-68795
Unauthenticated Broken Authentication in RegistrationMagic = 6.0.9.8 versions...
CVE-2026-82225
RegistrationMagic (Custom Registration Form Builder with Submission Manager) WordPress plugin versions ≤ 6.0.9.8 are affected by an unauthenticated Broken Authentication vulnerability, discovered by Emiliano Carrizo. The CVSS v3.1 score is 7.4 (HIGH) with a network attack vector, high complexity,...
CVE-2026-82225 WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in RegistrationMagic = 6.0.9.8 versions...
CVE-2026-82225 WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in RegistrationMagic = 6.0.9.8 versions...
CVE-2026-81762 WordPress Booking and Rental Manager plugin <= 2.7.6 - Broken Access Control vulnerability
Subscriber Broken Access Control in Booking and Rental Manager = 2.7.6 versions...
CVE-2026-81762 WordPress Booking and Rental Manager plugin <= 2.7.6 - Broken Access Control vulnerability
Subscriber Broken Access Control in Booking and Rental Manager = 2.7.6 versions...
CVE-2026-81762
CVE-2026-81762 is a Broken Access Control vulnerability in the Booking and Rental Manager WordPress plugin (for WooCommerce), affecting versions 2.7.6 and earlier . The flaw allows users with the Subscriber role to perform actions they should not be permitted to, resulting in a High integrity imp...
EUVD-2026-68786
Subscriber Broken Access Control in Booking and Rental Manager = 2.7.6 versions...
CVE-2026-81758
CVE-2026-81758 is a Broken Access Control vulnerability in the WordPress plugin OwnerRez API , affecting versions ≤ 1.2.6 . The flaw allows users with the Subscriber role to perform actions they should not be authorized for, as discovered by JunHee CHO via PatchStack. The CNA-assigned CVSS 3.1 sc...