CVE-2026-80191

GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts guards the check with a condition requiring the user to be non-null, so a request that carries n...

CVE-2026-80193

Kimai before 2.62.0 fails to validate createothertimesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with viewothertimesheet and editothertimesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassin...

EUVD-2026-66166

GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 suffers from a Broken access control vulnerability in the IP lock manager, which allows remote authenticated users to add, modify, or delete IP lock entries for arbitrary accounts via tools.php?action=iplock...

EUVD-2026-66167

A Broken access control vulnerability in the API user endpoint in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows unprivileged, authenticated users to enable or disable arbitrary user accounts via the req=disable or req=enable action using a normal user-created...

CVE-2025-70340

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below within the Alarms comments functionality. An authenticated customer user can manipulate API request parameters to create or modify system-generated alarm comments. This flaw allows for unauthorize...

PT-2026-81969

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before acting on it, allowing a user with a confirmed portal session to cancel, reactivate or modify subscriptions...

PT-2026-81945

Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar versions 9.0 through 9.7 Description An Insecure Direct Object Reference IDOR exists due to missing validation on a user-controlled key. This allows an authenticated attacker with Provider-level...

PT-2026-81942

The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces, allowing unauthenticated users to retrieve draft, pending and private posts belonging to other users, along with the passwords and contents of...

PT-2026-82242

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition PE 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows...

CVE-2025-70340

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition PE 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows...

PT-2026-82300

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project can retrieve the change history of restricted components in that project through nested API change endpoints, even without...

EUVD-2025-210791

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition PE 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows...

PT-2026-82219

Name of the Vulnerable Software and Affected Versions IDURAR ERP CRM affected versions not specified Description An issue exists where the system changes the password of any account specified in a request instead of the account making the request. The update handler in...

PT-2026-81959

The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards...

CVE-2025-70340

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition PE 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows...

CVE-2026-19197: Missing Authorization

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key broken access control...

PT-2026-81965

The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name,...

PT-2026-82368

Name of the Vulnerable Software and Affected Versions Drupal Blazy versions 0.0.0 through 3.0.18 Description An incorrect authorization issue allows forceful browsing. The module enables users to display a field of a target entity using a Blazy Filter plugin shortcode. Because the module does not...

CVE-2025-70340: Improper Access Control

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition PE 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows...

PT-2026-82334

Name of the Vulnerable Software and Affected Versions KubePi versions prior to 2.0.1 Description Cluster-scoped APIs do not consistently validate per-cluster access. This allows an authenticated user with cluster management permissions to operate on clusters outside their granted scope. Because t...