20134 matches found
CVE-2026-81658
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...
CVE-2026-81668
A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Conte...
EUVD-2026-67123
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...
CVE-2026-81817
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...
CVE-2026-81817 Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...
WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin WpEvently versions = 5.5.0...
WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin WpEvently versions = 5.5.0...
WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ACF Extended versions = 0.9.2.6...
CVE-2026-81658 Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...
CVE-2026-81658
Foreman is affected by an authorization flaw in its template revision endpoint , which does not enforce object-level authorization when retrieving audited template revisions. An authenticated, low-privileged user with a template-related permission (e.g., view_ptables) can retrieve historical temp...
CVE-2026-81274
Subscriber Broken Access Control in Ditty = 3.1.67 versions...
CVE-2026-81279
Subscriber Broken Access Control in Push Notification for Post and BuddyPress = 3.20 versions...
CVE-2026-81276
Unauthenticated Broken Access Control in Kali Forms = 2.4.23 versions...
CVE-2026-81272
Editor Broken Access Control in FluentPlayer Pro = 1.3.2 versions...
CVE-2026-27330
Unauthenticated Broken Access Control in Mobile App for WooCommerce = 0.4.62 versions...
EUVD-2026-66952
Subscriber Broken Access Control in Ditty = 3.1.67 versions...
CVE-2026-81274 WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability
Subscriber Broken Access Control in Ditty = 3.1.67 versions...
CVE-2026-81274 WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability
Subscriber Broken Access Control in Ditty = 3.1.67 versions...